I.T. Erudio

Author: Les

  • Mr Warhol and photography copyrights

    Since Andy Warhol died in 1987 – the Supreme Court was probably/technically ruling against his “estate” in their recent decision.

    Mr Warhol had used a photograph of Prince (“The Artist”) in a 1980’s painting (“Orange Prince”) – money changed hands among the concerned parties back in the early 1980’s so there wasn’t any problem until Prince Rogers Nelson died in 2016 and the Warhol image was used in some publications

    the crux of the issue was that back in the early 1980s Mr Warhol had paid for “one time use” of the photograph – SO was using Warhol’s painting in a magazine 30 years later a violation of the photographers copyright?

    Obviously the issue was convoluted enough that it ended up before the Supreme Court – so I won’t try to summarize it here – short form: the Supreme Court said “yes, the usage violated the copyright holders rights”

    Wait, what about Prince…

    now, ordinary folks might ask – what about the estate of “Prince Rogers Nelson” shouldn’t they have been involved somehow? well, again, the case was about COPYRIGHT – so it is the COPYRIGHT holder that was seeking redress

    SO when Prince’s music was played (assuming his estate still owned the copyrights) – THEY got paid, but the copyright holder of the photograph was/is the photographer.

    Just like in the music industry where “every time the music is played, SOMEONE gets paid” because of copyright – in the photography business “every time the picture gets used, someone gets paid” i.e. the copyright owner.

    Of course there is also the concept of “work for hire” – e.g. when Perry White sent out cub reporter Jimmy Olsen – the pictures Jimmy took belonged to the newspaper because they were paying young Mr Olsen to do a job.

    Peter Parker on the other hand was a freelance photographer for the JJ Jameson at the Daily Bugle – so Mr Parker got paid for his photographs and probably retained the rights to his work.

    I suppose if we could find a real copy of the Daily Planet the copyright notice on a picture Jimmy Olsen took would say “Copyright YEAR Daily Planet publishing” but a real copy of the Daily Bugle with a picture from Peter Parker would say “Copyright YEAR Peter Parker”

    In either case Superman or Spider-Man weren’t getting paid because they were performing in the public arena. Maybe they would have been received a “session fee” if they arranged a time and intentionally posed in front of the camera – but you get the idea …

    Public Photographs

    just in general if you are a “public person” doing your thing “in public” then photographs taken of you “in public” are the property of the photographer – e.g. this is how “paparazzi” make a living

    if you go to a Taylor Swift concert and take pictures of the performance – then YOU own the photographs and can do what you want with them.

    which means that it is possible for an artist to violate the copyright law by using a picture of themselves without the permission of the photographer. It happens on a regular basis.

    of course there is also the “Dave Chappell” solution where the performer can prohibit phones/cameras at the performance as a condition of entry — but that is an additional expense and MOST of the time performers want the publicity when they are “performing.”

    when they AREN’T performing is when the “negative” side of fame becomes an issue – but that is a different subject.

    Copyright

    The point of having “copyright laws” is to allow artists to profit from their creative work.

    There are folks out there that will argue that copyright laws “stifle creativity.” Well, you don’t need to be a student of history to see through that strawman argument.

    Consider Mr Shakespeare – writing 400+ years ago before “copyright laws” – how did he make “money?” Well, his “acting companies” had “benefactors” – which was why they were the “Lord Chamberlain’s Men” and then when King James I became their benefactor in 1603 thy became “King’s Men.” Then they also received money from performing productions/ticket sales.

    The idea of “publishing rights” back then was non-existent. The moveable type printing press had only made it to Europe in 1455 – so obviously “copyrights” were not an issue.

    Which means there were no “professional writers” back then – maybe a lot of “playwrights” and folks that had time to “write” as a hobby, but it was not possible to “make a living” as a “writer.”

    “If you would not be forgotten, as soon as you are dead and rotten, either write things worth reading, or do things worth writing.”

    Benjamin Franklin

    It should be pointed out that Mr Franklin made his fortune as a PRINTER. Ol’ Ben was obviously a gifted writer – but he made money by printing and selling his writing – so he understood the need for “copyright laws” as a profit incentive to creatives.

  • The GREATEST movie of ALL TIME

    well, the obvious problem with the title is “how do you define ‘great’?”

    of course everyone that has answered the question has been “correct” – “greatness” is determined by individual tastes. Consider that the credit for creating the “modern summer blockbuster” belongs to “Jaws” (1975) – which was the “greatest box office success” of all time until “Star Wars” (1977) – but if we did a survey of “movie critics” my guess is that neither movie would be in the top 10 if the question is “Name the greatest movie of all time”.

    Box Office

    Using “raw box office” as a measure of greatness had obvious problems. Most obvious is that “ticket prices” have increased greatly – e.g. in 1940 you could buy a movie ticket for $0.25 – a quarter of a dollar, in 2023 it is considerably more.

    If you want to use “ticket sales” as a measure of “greatness” OTHER problems pop-up. In this case “modern movies” expect to make MOST of their ticket sales in the first two weeks or release, will probably not be in wide theatrical release after four weeks, and will probably be available for “home consumption” (in the form of a digital download) in a few months after release.

    Before the mid 1980’s “home consumption” of a “major movie” would have been to show it on network television. There were “annual events” for some traditional favorites – “The Wizard of Oz” (1939) was shown annually from 1959 to 1991, “The Ten Commandments” (1956) is still shown annually around “Easter” Time.

    Once upon a time “Gone With the Wind” (1940) had been shown in the same theater for decades – so it is the hands down, never gonna be beat “ticket sales” champion movie of ALL TIME.

    Awards

    Remember that ANY “awards show” is inherently biased. The “Academy Awards” in particular are an “industry insider” group that – for the most part – gives out awards to other “industry insiders.”

    SO I notice the Academy Awards when they come out – but I do not consider them a “measure of greatness.” I’m not saying the awards are “not important” – certainly they are important to the folks that get nominated and/or win. I’m just pointing out that the awards are “voted on” by some group and are NOT useful for comparative purposes – e.g. if “movie A” won an Oscar but “movie B” did not win any awards does it automatically mean that “movie A” is BETTER than “movie B”? Nope.

    Categories


    Is being “ground breaking” the measure of “greatness?” “Birth of a Nation” (1915) helped create the “cinematic vocabulary” we take for granted (but the ending is obviously ‘problematic’) – “Citizen Kane” (1941) also broke ground on “camera movement and special effects” (which is why the ‘movie critics’ tend to love Orson Welles in general and “Citizen Kane” in particular) – “Casablanca” (1942) is in a category all its own but I’ll hold it up as an example of “script greatness.”

    to be fair (and for convenience) – there need to be multiple categories, “maybe greatest movie BEFORE ‘television’” (because the “studio movie” standards had to be raised when folks could get “basic entertainment” for free over the air – e.g. a lot of those “old movies” from the 30’s and 40’s feel like “television productions” in terms of length and content – e.g. “Frankenstein” (1931) and “Bride of Frankenstein” (1935) are around 1 hour each – watching them back to back tells a complete story)

    then we need to have a “greatest movie under the ‘studio’ system” AND “production code” category – if you are thinking “production code? what is that?” – well, there was a time when ALL movies where “general admission” – the MPAA didn’t come up with the “rating” system until 1968, BEFORE 1968 the “Production Code” was a form of self-censorship that put restrictions of “language and behavior” (e.g. try finding a “major U.S. movie” from before 1968 with profanity or nudity – I always love to point out “The Dirty Dozen” (1968) as working very hard to not use profanity)

    oh, and then there are the “not in English movies” – “Breathless” (1960) is a great movie (French crime drama). Akira Kurosawa’s work (Japanese director) had a HUGE influence on American cinema – e.g. even casual “western fans” have probably heard that “The Magnificent Seven” was based on Kurosawa’s “Seven Samurai”

    Personal Bias

    Since I was young and impressionable in the 1970’s the work of Steven Spielberg, George Lucas, and Francis Ford Coppola has a special place in the “nostalgia chest” – intellectually I can say that “Schindler’s List” (1993) is Mr Spielberg’s “greatest artistic achievement” while still saying I love “Jaws” and “Close Encounters of the Third Kind”.

    The Godfather and The Godfather part II are great movies – but my personal favorite “Coppola” movie is “Apocalypse Now.”

    As for Mr Lucas – “American Graffiti” (1973) is still a lot of fun to watch (and it foreshadows the “story telling” techniques used in the “Star Wars” franchise – at one level you can say that Mr Lucas was exploring the relationship between “man and machine” in both movies). “The Empire Strikes Back” is arguably a “better” movie than “Star Wars” or “Return of the Jedi”, but c’mon they didn’t even blow up a Death Star!

    No discussion on “big budget blockbusters” would be complete without mentioning James Cameron – I was blown away by the 3D effects in “Avatar” (2009) and “Titanic” (1997) was so full of special effects that people don’t think of it as being full of “special effects” (e.g. no, they did not build a replica of the Titanic – it was mostly “computer generated images” (CGI) – and that CGI was part of why it was the “most expensive movie” of all time back in the 20th Century).

    BUT my favorite “James Cameron” movies are “The Terminator” (1984) and “Aliens” (1986) – as always YMMV

  • Marketing and Propaganda

    In its best form “marketing”/”advertising” is just “information”

    If you have a great product that does “whatever” the best use of your “marketing” budget is to build awareness of the products benefits among folks that need to do “whatever it is that your product does”

    e.g. say you make beer or running shoes – and your goal is to continue to sell beer or running shoes.

    Spending time educating potential customers about the benefits of your beer or running shoes is gonna be much more effective than – I don’t know, randomly pushing a social agenda.

    e.g. The “craft beer” industry got its start by educating folks on how “good beer” should taste. The “athletic shoe” business had to educate/inform how their shoes improved performance.

    Leadership

    This is where competent leadership would say “hey, we are NOT a social advocacy company — we sell beer (or running shoes) so we are gonna concentrate on making the best beer (or running shoes) and leave the social advocacy for other folks”

    That doesn’t mean your company can’t be a “force for positive change” — i.e. being a “good corporate citizen” is always “good business.” It just means that your company has a product to sell and that shouldn’t involve “propaganda.”

    Donating to charities or allowing employees “personal time” to volunteer will have intangible benefits — but taking a “corporate stance” on “controversial” issues with marketing decisions is a pointless gamble.

    Studio System

    For most of the 20th century the above would PROBABLY have qualified as “corporate dogma” for MOST large corporations.

    Back in the old “movie studio system” where actors were “under contract” – the studio made an effort to control the public image of “movie stars” and wouldn’t let the actors express “controversial opinions.”

    why? because folks on both sides of the issue were potential customers – an actor expressing an opinion would (probably) offend SOMEONE – and that would mean “lower sales”

    Yes, they were selling an illusion, but the point was that the studio was NOT in the “advocacy business” – they were selling “escapism”/”entertainment”

    Michael Jordan pointed out that he intentionally was NOT “political” because “Republicans and Democrats both buy shoes” (or something along those lines).

    Freedom of Speech

    The modern business of sport is inherently tied to the “endorsement deal.” I don’t know if anyone can truly claim to have “invented” the idea of celebrity endorsements – i.e. the birth of “mass media” and “marketing” go hand in hand.

    Babe Ruth was the best baseball player in the world (and an all time great) at a time when “mass media” was shifting from newspapers to radio. Baseball was helped by radio, which meant that Babe Ruth’s value as a “celebrity endorser” was helped by radio. BUT while the Babe endorsed everything from “cereal to Girl Scout cookies to soap” I’m not sure if he made more money from “playing baseball” or from endorsements.

    Arnold Palmer (professional golf great) on the other hand made much more money from “endorsements” than he did from winning golf tournaments. This time Mr Palmer benefited from the growth of “television.”

    If a “modern sports star” was looking for an “endorsement” role model – Mr Palmer is probably hard to beat. I’m not a golfer – but I still think of his commercials for a particular motor oil when I’m buying oil.

    Of course the “products” that Arnold Palmer was selling were “golf” AND “Arnold Palmer” – I’m sure he had opinions of the controversial subjects of his day, and I’m sure he contributed to multiple charities, he just kept those opinions separate from his “golf professional image.”

    In 2023, I’m not opposed to an athlete expressing an opinion on “controversial subjects” – I just prefer that they have an educated opinion on the subject BEFORE they comment.

    Of course then “product endorsements” might be impacted by an athlete expressing their opinions. This withdrawal of “corporate approval” is NOT an attack of “freedom if speech” – again, the “company” needs to remember that it is in the business of selling a “product” NOT active propaganda.

    You keep using that word …

    Propaganda is “ideas, facts, or allegations spread deliberately to further one’s cause or to damage an opposing cause” — so is “propaganda” a form of “marketing?”

    well, maybe – “propaganda” USUALLY has a very negative connotation. Propaganda is biased and “selectively true” – i.e. trying to present YOUR idea/product in the best possible way – which might also be true of “marketing.” BUT propaganda allows for “allegations” meant to “damage the opposition” – which implies (at best) unethical behavior, which tends counter productive in the long term.

    Again “Good marketing” starts with a quality product/service. The goal is to educate folks on how YOUR product can help them solve a problem NOT convince them that your competitors are evil.

    Maybe if you have an inferior product/idea then selling “fear uncertainty and doubt” (FUD) is your only option — but wise leadership better serve a company by “repositioning” the product or developing a better product/idea.

    Marketing is NOT Manipulation

    My point is that “marketing” should equal “education” but NOT “manipulation.”

    If a group of “corporate executives” is sitting around thinking “We have the most popular product in the land. We have so much market share it is hard for any new marketing campaign to make a BIG difference one way of the other – you know what we should do? How about we hire a ‘spokesperson’ to advocate for a ‘controversial’ subject!” – well, it is probably time to get some new “corporate executives.”

    I cannot think of ANY product at ANY time that has been so popular that the parent company could try to “force feed” a radical agenda to their customers without losing a significant market share.

    If a company has “monopoly power” then their “marketing” doesn’t matter – but if there are multiple competitors and the cost of switching is just “I’m never buying that brand again – I will buy this other brand readily available from a competitor that hasn’t insulted my intelligence/integrity” – well, you will probably get “new executives” when the ones that made the terrible marketing blunder get fired

  • Profit Margins

    If a company is “profitable” over a long period of time that PROBABLY means it is “well run” or “managed properly.”

    Of course we need to define “long period of time” — in a healthy economy companies will come and go just by the natural cultural shifts and technological advances.

    e.g. Thirty years ago multiple companies making a nice profit from selling “long distance” phone service. Then the “interweb” exploded and “cell phones” became ubiquitous and I’m not sure anyone sells “long distance” phone service anymore.

    Prices

    the price of whatever “product/service” that “profitable company” makes is gonna be influenced by a wide range of variables

    A company can’t “lose a little money” on each transaction and expect to stay in business – so MOST reasonable people can appreciate that the idea of “profit” is not evil. However calculating acceptable “profit margins” (in the real world) is harder than plugging numbers into a formula (something like “profit = (revenue – cost)/revenue”)

    First – the sector/industry which the company is competing influences the idea of acceptable “profit margins.”

    e.g. the “oil industry” has to include some % to finding/acquiring “more oil” – the “lumber industry” has to include some % to “planting trees” – the “pharmaceutical industry” has to include some % for “research, development, and approval” of new drugs

    Second – “marginal utility” comes into play and really messes with “prices.”

    How much “the market” is willing to pay for a product is influenced by how much of that product they “need.”

    Remember there is a difference between “need” and “want.” Real “needs” are things like food/water/shelter. Needs are (relatively) limited. “Wants” on the other hand are unlimited – but will vary wildly between individuals.

    e.g. an individual that is hungry, cold, and lost in the wilderness would be willing to pay much more for a “plate of beans by the fire” than someone that is living in a nice warm house with plenty of food.

    The “value” of diamonds and water are another classic example – if you are dying of thirst, you will “pay” for water and (probably) aren’t concerned with diamonds of any quality. But if you have all the water you need (you know, it tends to fall out of the sky in certain places) – then “shiny things” like diamonds are worth a lot more.

    Cost

    Of course just because “water” can be obtained for free – that doesn’t mean there isn’t a “market” for water. The problem with water is that it is easily contaminated. Historically “dirty water” has been the cause of a LOT of epidemics – which is another subject.

    “Water” may be obtained for “free” – but “clean potable water” doesn’t happen by accident. SO “bottled water” is its own little industry. The larger point being that the “product cost” is not directly linked to the “product price.”

    The same would be true for diamonds – i.e. raw diamonds require some additional work to become “jewelry.”

    SO with any product the company selling the products has other “production costs” than just “materials.”

    If those additional costs are managed poorly – then a product that costs $0 could be sold for “$large number” and the company might NOT be “profitable.”

    OR if those additional costs are managed properly – then the “total cost of production” might be lower so the “product price” might be lower AND the company would be “profitable.”

    Of course it is also possible for a company to have “record profits” despite poor management — but those tend to be short lived “bubbles.”

    As for the stock market: what the “stock market investor” wants to see in a company is “slow and steady” long term growth. Meanwhile the “stock market speculator” is looking for “wild swings” in profits.

    The “intelligent investor” will do more “investing” than “speculation” – I think someone won a Nobel Prize in economics for pointing out that “diversification” was a good thing – which is basically saying that a little “speculation” is a good thing for “long term profits.” This is why “investment professionals” will talk about “risk appetite.”

    In an ideal case our ‘well managed company’ would see slow and steady profit growth year over year. Each year may not set a new “record” for profits, but the graph line would be sloping upwards.

    While that “hot new company” in an “emerging industry” PROBABLY won’t show profits at all for the first few years – but that doesn’t mean an investor shouldn’t risk a small % …

    SO “diversification” is going to look differently for different investors at different points in their lifetime – but the “big idea” is that (from a financial planning point of view) you should never put EVERYTHING into anything …

    Government intervention

    My internal alarms start going off anytime a “government official” starts talking about a company/industry having “record profits” and how this isn’t “fair” to the public.

    Well, we have the “history of socialism/communism in the 20th Century” to point out the dangers of “centrally planned economies.”

    If you want to argue that the USSR and Maoist China were not “true communism” – fine. I understand the difference between the “speculative economics” that Karl Marx wrote about and the “real world implementation” of tyranny done under his name – that isn’t the point.

    The point is that any human government intervention into individual sectors of the economy tends to be counterproductive. Modern economies are vast and complex and change at a pace faster than human government and effectively regulate.

    I can appreciate the goal of “fairness” – but the problem is human nature and “information flow.” Is the purpose of government is NOT to make society “fair.” That simply is not possible with human government.

    I’m not questioning the “intent” of attempts at socialism – I’m pointing out the failures of trying to arbitrarily change human nature and the problems of “scarcity.”

    Mr Marx expected “capitalism” to solve the “scarcity” problem – and then “communism” would happen naturally. I tend to disagree with his hypothesis that if all of humanities basic needs were met that we would live together in peace and harmony – again, “human nature” comes into play.

    But it is pretty to think that Mr Marx wasn’t completely wrong (but again, 20th Century history isn’t on his side)

    The most terrifying words in the English language are: I’m from the government and I’m here to help.

    Ronald Reagan

    All of which means that by the time “government reacts” the problem has probably changed and any government regulation is going to be pointless and ineffective.

    This is why “do something” legislation after a “disaster” might actually make the root problem worse — and “don’t make things worse” is probably a good goal for any human government.

    Of course being able to tell the difference between “we must act now” and “it is better to do nothing” is VERY hard. It does illustrate why “politicians” tend to be despised and true “statesmen”/leaders are few and far between …

  • … have a drink on me

    … “spirits” as a reference to “distilled alcohol beverages” apparently traces back to the belief that they drinks held the “life force” (i.e. “spirit”) or the “essence” of the grains or plants that were used.

    the English word “spirit” (first usage as a noun – 14th Century) traces back to the Latin “spiritus” (literally, breath, from “spirare” to blow, breathe – thank you Merriam-Webster)

    SO most likely folks figured out how to make wine and beer first – then the wine makers figured out the distillation process, and we got things like “aqua vitae” and whiskey/whisky. fwiw: If the product is made in America or Ireland – it is most likely called whiskey (notice the ‘e’) and the rest of the world spells it without the ‘e’ – so we get “Scotch whisky” but that is “Jim Beam Bourbon Whiskey”

    for most of American history (well, probably right up to the “prohibition era” – 1920-1933) whiskey almost had the status of “legal tender.” In an era before mass transit and refrigeration making whiskey was simply good business – i.e. an in demand product that had a long shelf life and could be transported (relatively) easily.

    Of course in 2023 making “spirits” is still very profitable for the same reasons – but distillation of alcohol is also heavily regulated for various reasons — e.g. protecting public health (e.g. if done incorrectly you get methanol – which will kill you fast – instead of ethanol – which will also kill you, just a little slower), and collecting tax $$ being the big factors.

    Oh, and “home brewing” of beer became legal in the 1970’s — I don’t know if “making wine” for “personal consumption” has ever been illegal in the U.S. (i.e. I’m pretty sure “home wine making” was still allowed even during the “prohibition era” – for “religious/cultural” reasons, but I’m not 100% on that)

    … but of course if you mess up the wine or beer making process – you just end up with something that tastes bad, but isn’t likely to kill you fast. Transporting beer between state lines used to be illegal (e.g. the plot for “Smokey and the Bandit”). Living in Ohio we couldn’t (legally) get “Yuengling” beer from Pennsylvania until 2011 – there are conflicting stories on “why” it took until 2011, but I’m sure its “root cause” goes back to prohibition era laws (e.g. the two states border each other – so you would think that Ohio would have been one of the first States to get “Yuengling distributors” rather than the last).

    random observation — a “beer truck” was involved in an accident in Ohio recently – I was a little concerned and then I saw pictures of cases of “Coors Light” and thought “that wasn’t a beer truck – that was Coors Light – which isn’t the same thing (ok, I like darker, heavier beers – neither “Bud” and/or “Coors” are at the top of my “preferred list”)

    ANYWAY – the idea of the “mixed drink” is probably as old as “drinking.” From an “ancient history” point of view alcoholic beverages were always “watered down” before being consumed – this was probably the same idea as modern “carbonated beverage” distribution. e.g. “fizzy drink maker” sells the “drink syrup” to establishments that then add the carbonation before serving to customers – which is how restaurants are able to give “free refills” on “fountain drinks” and “fast food chains”/”convenience stores” can sell “huge drink” for $1 — so the “wise ancients” would have stored their wine/liquor in a more concentrated form – and then added water to adjust for “proof”/potency

    random thought: for “mixed alcohol drinks” larger ice cubes tend to be used (primarily) because the cubes melt slower, and therefore don’t dilute the drink as much – and if you are paying for some exotic concoction that comes with ice in the glass, you might care how it tastes – i.e. no ice served with “shots” but they will probably have been “chilled” if requested or if the bartender wants to put on a show.

    For whiskey they have “whiskey stones” that can be chilled and won’t melt – but they come across as gimmicky to me – maybe add a drop of water to that high quality whiskey/whisky to activate the flavors, and if you are “drinking for effect” don’t pay for the good stuff

    The “modern cocktail” is sometimes described as the United States’ contribution to world “liquor culture.” The short form idea being that a lot of “cocktails” were created to mask the taste of bad liquor mass produced (illegally – you know gangsters/bootlegging/that whole thing) during prohibition — Winston Churchill’s quote about how to make a martini (“Glance at the vermouth bottle briefly while pouring the juniper distillate freely.”) illustrates the point that “high quality gin” (which Mr Churchill would have been drinking) didn’t require vermouth to make it palatable).

    That same concept kind of applied to “tough guy” drinks – e.g. the cowboy is drinking whiskey while standing at the bar – the hard-boiled private eye had a bottle of whiskey in a desk drawer. Philip Marlowe tended to drink “Gimlets” which (originally) was just gin (or vodka) and lime juice – but you can add simple syrup if you want it sweeter. The “Gimlet” name most likely traces back to a 19th century British Navy Doctor (Rear-Admiral Sir Thomas Desmond Gimlette) – who suggested adding lime juice to Officers “daily ration” of gin (enlisted men got rum – add lime juice to the rum and you get “Grog”)

    Glance at the vermouth bottle briefly while pouring the juniper distillate freely.

    Winston Churchill

  • To REALLY mess things up …

    SO, I tried to change “permalinks” in WordPress and ALL the links broke.

    I’ve been using WordPress for years – but to be honest I’ve never tried to do anything “complicated” (i.e. beyond the “content management” for which WordPress is designed).

    Of course this “blog” thing isn’t making me an $$ so I don’t put a lot of effort into WordPress “customization” – i.e. it doesn’t REALLY matter what the “permalinks” look like.

    “Optimized URLs” used to be a “search engine optimization” (SEO) thing (well, it probably still is a SEO thing) — so I’m not saying that “permalink structure” isn’t important. I’m just pointing out that I haven’t had a reason to change it from the default.

    And Then…

    Like I said, WordPress is great for the occasional “blog” posting – but then I wanted to do some “web 1.0” type file linking – and, well, WordPress ain’t built for that.

    Yes, there are various plugins – and I got it to work. AND THEN —

    I should also mention that I’ve tried launching various “Facebook pages” over the years. One is Old Time Westerns.

    Now, Facebook as a platform wasn’t real sure what “pages” were for – my opinion is that they were basically TRYING to create a “walled garden” to keep users on Facebook – and then of course users see more Facebook ads.

    No, I am NOT criticizing Facebook for offering new services trying to keep people on Facebook — but “Facebook pages 1.0” weren’t particularly useful for “page creators.” In fact Facebook wanted (wants) page creators to PAY to “boost posts” — which functionally means NOTHING goes “organically viral” on Facebook.

    Again, I’m also NOT criticizing Facebook for wanting to make $$ – but no, I’m not going to PAY for the privilege of doing the work of creating a community on a platform, which can decide to kick me off whenever they like.

    Did I mention …

    … I have the required skills to do the “web publishing” thing – so for not much $ I can just setup my own servers and have much more control over anything/everything.

    SO the motivation behind the “Westerns” page was more about me getting in my “amateur historian” exercise than about building a community.

    Ok, sure, I would love to connect with people with the same interests – which is one of those things the “web” has been great at from the “early days.” Notice that I didn’t day “Facebook” is great a finding people of common interests, but the Internet/Web is.

    Facebook is great to “reconnect” with people you once knew or have met – but not so good at “connecting” new people with a common interest.

    Hey, if you are “company” selling “product” and you have a marketing budget – then Facebook can help you find new customers. If you are “hobbyist” looking for other “hobbyists” – well, not so much.

    Yes, Facebook can be a tool for that group of “hobbyists” – but unless you have a “marketing budget” don’t expect to “organically” grow you member list from being on Facebook.

    fwiw: “Facebook pages 2.0” has become “groups” or something – Wikipedia tells me Yahoo! pulled the plug on “Yahoo! Groups” in 2020. The “fun fact” is that the whole “groups” concept predates the “web” – that sort of “bulletin board” functionality goes back to the late 1970’s early 1980’s. Remember the movie WarGames (1983)? That was what he was “dialing into.”

    ANYWAY …

    I have various “example” sites out there – I’ve pointed out that WordPress does somethings very well – but doesn’t do other things well.

    Yes, you could “extend” WordPress if you like – but it isn’t always the “right tool for the job.”

    SO “data driven example” https://www.iterudio.com/us —

    small “progressive web app”: https://media.iterudio.com/j/

    Another “data driven example” – but this time I was trying to create a “daily reading app” from a few of the “wisdom books”: https://clancameron.us/bible/

    A “quote app”: https://clancameron.us/quotes/

    AND then the latest – which is just javascript and css https://www.iterudio.com/westerns/

    The original plan was to just create some “pages” within WordPress – and I wanted the URL to be “page name” — which is why I was trying to change the “permalinks” within WordPress.

    My guess is that the problem has to do with the fact the the “uniform resource locator” (URL) on my server gets “rewritten” before it hits the WordPress “permalink” module – which then tries to rewrite it again. The error I was getting seems to be common – and I tried the common solutions to no avail (and most potential solutions just made the problem worse).

    To err is human; To really foul things up requires a computer.

    Anonymous

  • Simple Fitness part 2 – the interval trainer

    Google tells me that the “fitness industry” was forecast to pass $32 billion in 2022. Which means that “personal fitness” is more than a New Year’s resolution for a large number of people.

    Elite Athletes

    “Exercise Science” has become a more rigorous academic discipline than the old “physical education” catch all. My guess (100% me guessing – just my opinion) is that most “high schools” now have a “strength and conditioning” coach of some kind – at smaller schools it might be a part-time supplemental job held by a teacher/coach of another sport (probably football).

    All of which means that there is a vast amount of “information” out there. If you are an “elite athlete” or if you are responsible for training “elite athletes” there are a lot of factors to consider when designing a “training program” for competition. Much of that information is “sport specific” — e.g. training for “golfers” is much different than training for “marathon runners”.

    The days of athletes “reporting to training camp” and “getting into shape” DURING “training camp” are long gone. The average “elite” athlete probably treats their sport as a year round obligation – and might spend hours everyday “working out” in the off-season to prepare.

    General Fitness

    But wait – this isn’t an article about “elite athlete training.”

    A large amount of research has been done confirming that a “sedentary lifestyle” is actually a health risk. The good news is that recommendations for “exercise for general health” haven’t changed much.

    It would be “best” to get 30 minutes of low to moderate exertion level exercise most days of the week. The exercise doesn’t have to come in one continuous 30 minute period – again the “best” option would probably be multiple 10 minute periods of exercise spaced out over the day.

    Which means if you work in an office building and can make the walk from “car” to “office” take 10 minutes (park at the end of the parking lot, take the stairs) – that would have SOME health benefits — but that is just a made up example, not a recommendation.

    If you are sitting in front of a computer all day – then you should (probably) also stand up and move around a couple minutes each hour. Again, your situation will vary.

    Interval Training

    If you hate to exercise (or if you have trouble finding the time to exercise), but recognize that you “should” exercise – “interval training” might be a good option.

    The idea of “interval training” is that you alternate periods of “high exertion” with periods of “low exertion.”

    Runners might be familiar with the idea of “fartlek training” (Swedish for “speed play”) – where periods of “faster” running are alternated with periods of “slower” running. Google tells me the practice goes back to the 1930’s – and I’m going to guess that MOST “competitive” runners are familiar with the concept.

    From a practical point of view the “problem” becomes keeping track of “rest” and “relief” times.

    With a “fartlek” run in the U.S. you might be able to alternate sprints and jogging between utility poles — assuming your running path has “utility poles.”

    In a “gymnasium” environment “circuit training” becomes an option — e.g. 20 second “work” times followed by 10 second “relief” times (when exercises could be changed if using resistance training or calisthenics.

    Personally I get bored doing the same routine, don’t really want to go to a “gym”, have an abundance of old computers, and some “coding skills.” SO I wrote the little application below.

    Download

    Interval Trainer start screen
    “Select Workout”
    Workout selected

    workout started with a 1 minute “warm-up”

    Since I designed the application of course it seems “obvious” to me — just a simple countdown timer combined with “work” and “rest” intervals.

    Specific “work” and “rest” periods can be entered — e.g. if you wanted to do a “boxing gym” workout you could set the “interval” count to 15, “Work Time” to 3, and then “Rest Time” to 1 – and you would get 1 hours worth of “rounds.”

    The very generic “General Fitness” workout is 5 intervals consisting of 1 minute of “work” and 2 minutes of “active rest” periods — there is a “clacking sound” at 10 seconds remaining and a “bell sound” between periods.

    Exercises

    I like using an exercise bike or a “step” for my intervals – but you can do whatever exercise you like. e.g. Jumping rope or “burpees” would also be good options.

    For “beginners” doing calisthenics for 1 minute is probably not realistic – but it would be a good workout for a college wrestling team.

    You will get more out of the workout if you “walk around” during the “Active Rest” period.

    Core Strength

    There is a “20 second work/10 second rest” option under “Select Workout” – which is a good example for a “planking” type exercise for “core strength”/calisthenics intervals.

    e.g. As an “ex-athlete” over a certain age – the 20/10 intervals are surprisingly tough. But again “currently a competitive athlete” could start with the same workout – they would just get more repetitions done in the same amount of time (and would recover faster).

    If you are looking for something tougher/more challenging – there are a lot of “High Intensity bodyweight” exercise routines out there on the interweb – but again, be careful. Going too slow at the start is MUCH better than “jumping in head first” and getting injured …

    Simple – not easy

    If you do the General Fitness intervals three days a week (ideally with a day in between workout days – e.g. Sunday – Tuesday – Thursday, or Monday – Wednesday – Friday) and then some 20/10 “planks” for core strength (or do push-ups for 20/10 intervals) that is a “not bad” beginner workout.

    Do that workout for six weeks and then maybe think about upping the “intensity” – or start doing the workout 4 or 5 days a week.

    Coaches

    I wrote this application for myself – and it could obviously be improved. I could add a “save custom workout” option with a little effort if there is an interest.

    From MY point of view “coaches”/personal trainers are the folks that would find a “save custom workout” option useful — and there would be “time and effort” involved.

    Download

    The download has been tested on 64 bit versions of Microsoft Windows. I have a “Mac mini” so compiling a OSX version might be an option (if someone actually needs it). Same idea for Linux …

    Download Here

  • talkin football

    The NFL “divisional playoffs” were this weekend (January 22, 2023) – I thought the “better teams” all won today (Cincinnati beat Buffalo, San Francisco beat Dallas)

    Bengals

    The final score was Bengals 27 – Bills 10. To my eyes the Bengals are playing like a championship team – I’m not predicting anything, just saying that they are doing a lot of the things that championship teams do.

    Of course the Bengals continue to be disrespected by the “experts” simply because, well, they are the Bengals.

    e.g. The “spread” was Bengals +6 – which means that the Bills were a 6 point “favorite.”

    Sure the Bills were the home team, and they are obviously also a very good team composed of professional athletes – but a 6 point favorite?

    Well, you see the “line”/”point spread” in a football game is about getting equal money bet by both sides – then the “house” is guaranteed a % of the money wagered – no matter who wins.

    The “spread” isn’t about which team is actually better – it is completely about how money is being wagered on the game. Which again comes back to my point that the Bengals are being disrespected by the “experts”

    Experts

    Full disclosure – I don’t enjoy “picking” football games. Just in general I don’t bet on sports.

    As a “seasoned fan” I don’t bother to watch much “pre-game” coverage. I’ll turn on the game just before kick-off and usually mute the ‘announcers” and listen to music during the game.

    HOWEVER – when I was a “not so seasoned fan” I would sometimes watch ALL of the pre-game coverage, then the games, then watch the highlight shows. SO I’ve listened to a lot of “television experts” predict football games.

    There was an old “football expert” by the name of Jimmy “the Greek” Snyder who used to predict NFL game scores back in the 1970s/80’s.

    Now, ol’ Jimmy was probably wrong more than he was right – I don’t remember ever hearing his “correct/incorrect” numbers – but he was also a “Las Vegas bookmaker” so his win/lose record was MOSTLY irrelevant.

    Again, if you are a “bookmaker” you just want a lot of money bet ON BOTH TEAMS – so then you are guaranteed to make money not matter who wins.

    ANYWAY – at the end of his career (before he said something inappropriate and got himself fired in 1988) ol’ Jimmy loved himself some Dallas Cowboys (and in his defense the Cowboys were very good in the late 70’s and early 80’s).

    The problem was that the Cowboys as a franchise had some problems in the mid 1980’s (which culminated in a change of ownership in 1989), and were just not a good team – but ol’ Jimmy kept on picking them to win

    from a “psych 101” point of view ol’ Jimmy “The Greek” was suffering from a bad case of “confirmation bias” in regards to the Cowboys — i.e. he keep expecting them to be championship contenders because they had been championship contenders for so long.

    And that brings us to the 2022 Dallas Cowboys. They lost to the San Francisco 49ers today 12 – 19. The line was Cowboys +4.

    My guess is that the “betting public” made the “point spread” smaller in the Dallas game and larger in the Bengals games because of “confirmation bias” — i.e. the general public expects the Cowboys to be better than they are and for the Bengals to be worse.

    Which is why they play the games …

    My opinion on the Bengals win is that the Bengals were the “better team” today. The Bills certainly didn’t “quit” or “play poorly” so much as the Bengals played very well as a team and were in control from start to finish (they looked like “Champions”).

    ‘dem Cowboys

    The Cowboys had another “golden era” in the early-mid 1990’s – winning 3 Super Bowls in 4 years. But haven’t been back to a Super Bowl or Conference championship game since 1995.

    In that 27 year “championship game” drought they have only had 7 losing seasons. Team Owner Jerry Jones is willing to invest money in the team, they have a state of the art stadium, and a large passionate fan base – i.e. if there is a “recipe for success” the Cowboys have been following it.

    Watching the game today – my opinion was that the teams were “physically equal.” It was a close, entertaining game but I would describe it as the “Cowboys lost” just as much as the “49ers won.”

    No disrespect for San Francisco – they are another “doing things right” franchise (but they have made a couple Super Bowl appearances since their “golden era” back in the 1980’s/90s).

    But the Cowboys continue to make “small mistakes” that are hard to justify/explain.

    The Steelers Hall of Fame Coach Chuck Knoll once said that “Before you can win the game, you have to not lose.”

    “Before you can win the game, you have to not lose.”

    Chuck Knoll

    Yeah, it is a great “football coach” quote – what he (probably) meant is that more games are “lost” because of players making (self-inflicted) mistakes than are ‘won” by players making great plays.

    SO the Cowboys have a lot of very talented players – that managed to find a way not to win. I have an opinion on the “why” of the Cowboys continued “non championship” run – but it is just an “opinion” and it isn’t important or useful at the moment …

    To the 49ers credit, they let the Cowboys make those mistakes, took the win – and will play next week against the Eagles.

    BUT I didn’t get that “championship” feel from the 49ers – that doesn’t mean they won’t win against the Eagles. The Eagles are very good and were dominant in their win – but the Giants had that “happy they won last week” look – so the game will be interesting …

  • Simple Fitness

    “Fitness” does not need to be complicated and time consuming. The amount of exercise required to “prevent disease” is relatively small – but there are enough variables to make the subject confusing.

    SO I’m going to try to boil the subject down as much as possible.

    I will start by saying that I am NOT a “fitness professional.”

    Once upon a time I thought of myself as a competitive athlete (a LONG time ago). Also “once upon a time” I earned the CSCS from the NSCA (“Certified Strength Conditioning Specialist” from the “National Strength and Conditioning Association”), and passed the ACSM (“American College of Sports Medicine”) “personal trainer” exam about that same time.

    All of which means next to nothing.

    HOWEVER – I’ve looked at the current research, have an “informed opinion”, and might be “certified” again if I make the effort.

    The problem is that there is a LOT of “fitness” information in the marketplace – sorting through the irrelevant information can take some effort.

    First things first

    FIRST we must distinguish between “fitness for health” and “sports conditioning.”

    There is no consensus on the most effective way to train competitive athletes. There are just too many variables.

    Obviously “sports conditioning” is going to be “sport specific” – the “best” workout for “long distance runners” will look almost nothing like the “best” workout for “NFL offensive lineman.”

    Then “great athlete’s workout plan” isn’t going to work for everyone in that sport. No, I’m not saying that “great athlete” shouldn’t write a “workout book” just that the athlete’s individual workout plan PROBABLY won’t “translate” to the general public. Again, too many variables – so those type of books become “fitness memoirs” much more than “books on fitness.”

    To be honest – since the field of “exercise science” has developed over the last 40+ years, the number of “celebrity workout books” has declined. Of course being a “trainer to the stars” is probably still a good “blurb” for a fitness book – i.e. the celebrity’s “personal trainer” might write a book.

    However, having six-pack abs and great genetics does not equal “source of good advice.” Particularly with “sports conditioning” – great athletic ability tends to cover up a large number of “workout flaws.”

    Consider the myth of an ancient Greek wrestler named “Milo.” Milo supposedly trained by picking up a newborn calf and carrying it around all day. Milo continued to carry the calf around as it grew, until eventually he was carrying around a full grown cow. Obviously he would have had to be incredibly strong – and was unbeatable as a wrestler.

    I’m not sure Milo’s workout method would work for “non myths.” (but if you know someone training that way – I’d love to meet them)

    SO a lot of “fitness books” make that some error. They prescribe “what so and so likes to do” as opposed to “what will work for the general population.” I’m not saying all “celebrity workout books” are useless – but let the buyer beware.

    The point is that “fitness for health” can be very simple. The consensus is that “doing anything is better than doing nothing” and then doing “more” UP TO A POINT is GENERALLY better.

    Benefits of exercise

    I’m not going to give you a long list of benefits of physical activity. The “long term” benefits all revolve around increased “quality of life.” You are NOT going to live forever in this human body, but you will feel better and be able to function better as you age if you engage in regular physical activity.

    Again, anything is better than nothing. The “minimum recommendations” is still 5 days per week of 30 minutes of “moderate intensity exercise” or 20 minutes of “vigorous intensity exercise” 3 days a week. Doing “strength training” a couple times a week is also recommended.

    The big danger is being “sedentary” for long periods of time. It would be “best” to spread out activity during the day than to do one long exercise session and then sit all day.

    Why people don’t exercise?

    The “fitness industry” recognizes the “New Year’s resolution” market – i.e. every year a large number of folks make a “resolution” to “exercise more”/”get in shape” in the coming year.

    Obviously that means that people are aware of the need to/benefits of exercise. Why do so many not follow through on their “fitness resolution?”

    Well, why any one person isn’t exercising is probably due to a combination of factors.

    As a long time observer of “human nature” my guess is that the average “new year’s resolution” to exercise is unrealistic.

    Notice that I’m not saying “insincere” – i.e. they honestly intend to try and will make a genuine effort.

    No, I’m saying “unrealistic” in the same way that trying to replicate Milo’s workout is “unrealistic” for ordinary mortals.

    Ok, say that “apparently healthy” individual has made a resolution to “start exercising.” Our sincere individual makes a plan to get up at 5:30 in the morning, run 2 miles, go to the fitness center and do 30 minutes of weight training, then go to work all day.

    If our individual normally sleeps until 7:30 and has to rush to get to work on time – they may set the alarm for 5:30, but hit the snooze button multiple times. They skip the run, and go to the fitness center, which is packed with other resolution makers – so they decide to skip the weight training until next week when it will be less crowded … and then they slide back into their normal routine and the resolution isn’t kept.

    OR – if the “resolution maker” does get up and go for that 2 mile run, and then lifts those weights – they are so sore the next day that they have to call in sick.

    Well, since “delayed onset muscle” soreness tends to be worst 40 hours after exercise – maybe our resolution keeper makes it 2 days, and THEN they can’t move.

    Plan for success

    I’m not criticizing anyone, just pointing out that if you want the “fitness resolution”/any change in behavior to become permanent we need to gradually make small changes.

    Goal 1 should be “setting yourself up to succeed.”

    Remember “anything is better than nothing.” Just making “physical activity” a part of your daily schedule should be “Step 1.”

    Logically “Step 2” should then consist of “time and activity.” If you haven’t been physically active this might translate to “activity you hate least” – but you can always change your workout activity, establishing a routine is the point.

    There was a study a few years back that came up with a “15 minute drive” number – if a person has to drive more than 15 minutes to the gym, then they won’t stick with their program.

    I think they were trying to get more fitness centers built, but the point is obviously worth considering. If you don’t have facilities near by, recognize that you might be setting yourself up for failure IF your plan involves driving over 30 minutes to and from the gym.

    Home Gym

    A sure way to get around the “drive time” problem is a home gym. There are numerous “home workout” options – ranging in cost from “inexpensive” to “wow.”

    The obvious problem is that the “home gym” can become a clothes hanger and not used just as easily as the gym membership can be abandoned.

    There is no “best exercise device” – treadmills, rowers, stationary bikes, and “climbers” can all provide great workouts – but if you don’t like the exercise then the machine will just be an expensive place to hang clothes.

    You always tend to get what you pay for – so try before you buy if possible.

    Know Yourself

    Generic advice time: Any “change” is easier if you have a “support group” of some kind.

    A secondary benefit to joining a “fitness facility”/rec center is “group exercise” classes. If you have a workout partner that also commits to the class then you are both more likely to continue.

    Again, if you hate the exercise and/or aren’t motivated by the group – then just because you have spent money on a class doesn’t mean you will attend.

    If you enjoy the social aspect of “exercise classes” then there are other health benefits – but if you want/need to minimize your workout time because of schedule restrictions “classes” probably aren’t for you.

    There are low cost, fast, and effective exercise routines that can be performed at home. One of these is “interval training”/”circuit training.” Which I will discuss in another article…

  • authentication, least privilege, and zero trust

    When we are discussing “network security” phrases like “authentication”, “least privilege”, and “zero trust” tend to come up. The three terms are related, and can be easily confused.

    I’ve been in “I.T.” for a while (the late 1980’s) – I’ve gone from an “in the field professional” to “network technician” to “the computer guy” and now as a “white bearded instructor.”

    Occasionally I’ve listened to other “I.T. professionals” struggle trying to explain the above concepts – and as I mentioned, they are easy to confuse.

    Part of my job was teaching “network security” BEFORE this whole “cyber-security” thing became a buzzword. I’ve also had the luxury of “time” as well as the opportunity/obligation to explain the concepts to “non I.T. professionals” in “non technical jargon.”

    With that said, I’m sure I will get something not 100% correct. The terms are not carved in stone – and “marketing speak” can change usage. SO in generic, non-technical jargon, here we go …

    Security

    First, security as a concept is always an illusion. No I’m not being pessimistic – as human beings we can never be 100% secure because it is simply not possible to have 100% of the “essential information.”

    SO we talk in terms of “risk” and “vulnerabilities.” From a practical point of view we have a “sliding scale” with “convenience and usability” on one end and “security” on the other. e.g. “something” that is “convenient” and “easy to use”, isn’t going to be “secure.” If we enclose the “something” in a steel cage, surround the steel cage with concrete, and bury the concrete block 100 feet in the ground, it is much more “secure” – but almost impossible to use.

    All of which means that trying to make a “something” usable and reasonably secure requires some tradeoffs.

    Computer Network Security

    Securing a “computer” used to mean “locking the doors of the computer room.” The whole idea of “remote access” obviously requires a means of accessing the computer remotely — which is “computer networking” in a nutshell.

    The “physical” part of computer networking isn’t fundamentally different from the telegraph. Dots and dashes sent over the wire from one “operator” to another have been replaced with high and low voltages representing 1’s and 0’s and “encapsulated data” arranged in frames/packets forwarded from one router to another — but it is still about sending a “message” from one point to another.

    With the old telegraph the service was easy to disrupt – just cut the wire (a 19th century “denial of service” attack). Security of the telegraph message involved trusting the telegraph operators OR sending an “encrypted message” that the legitimate recipient of the message could “un-encrypt.”

    Modern computer networking approached the “message security” problem in the same way. The “message” (i.e. “data”) must be secured so that only the legitimate recipients have access.

    There are a multitude of possible modern technological solutions – which is obviously why “network administration” and “cyber-security” have become career fields — so I’m not going into specific technologies here.

    The “generic” method starts with “authentication” of the “recipient” (i.e. “user”).

    Authentication

    Our (imaginary) 19th Century telegraph operator didn’t have a lot of available options to verify someone was who they said they were. The operator might receive a message and then have to wait for someone to come to the telegraph office and ask for the message.

    If our operator in New Orleans receives a message for “Mr Smith from Chicago” – he has to wait until someone comes in asking for a telegraph for “Mr Smith from Chicago.” Of course the operator had no way of verifying that the person asking for the message was ACTUALLY “Mr Smith from Chicago” and not “Mr Jones from Atlanta” who was stealing the message.

    In modern computer networking this problem is what we call “authentication.”

    If our imaginary telegraph included a message to the operator that “Mr Smith from Chicago” would be wearing a blue suit, is 6 feet tall, and will spit on the ground and turn around 3 times after asking for the message — then our operator has a method of verifying/”identifying” “Mr Smith from Chicago” and then “authenticating” him as the legitimate recipient.

    Least Privilege

    For the next concept we will leave the telegraph behind – and imagine we are going to a “popular music concert.”

    Imagine that we have purchased tickets to see “big name act” and the concert promoters are holding our tickets at the “will call” window.

    Our imaginary concert has multiple levels of seating – some seats close to the stage, some seats further away, some “seats” involve sitting on a grassy hill, and some “seats” are “all access Very Important Person.”

    On the day of the concert we go to the “will call” window and present our identification (e.g. drivers license, state issued ID card, credit card, etc) – the friendly attendant examines our individual identification (i.e. we get “authenticated”) and then gives us each a “concert access pass” on a lanyard (1 each) that we are supposed to hang around our necks.

    Next we go to the arena gate and present our “pass” to the friendly security guard. The guard examines the pass and allows us access BASED on the pass.

    Personally I dislike large crowds – so MY “pass” only gives me access to the grassy area far away from the stage. Someone else might love dancing in the crowd all night, so their “pass” gives them access to the area much closer to the stage (where no one sill sit down all night). If “big recording executive” shows up, their “pass” might give them access to the entire facility.

    Distinguishing what we are allowed to do/where we are allowed to go is called “authorization.”

    First we got “authenticated” and then we were giving a certain level of “authorized” access.

    Now, assume that I get lonely sitting up there on the hill – and try to sneak down to the floor level seats where all the cool kids are dancing. If the venue provider has some “no nonsense, shaved head” security guards controlling access to the “cool kids” area – then those guards (inside the venue) will check my pass and deny me entry.

    That concept of “only allowing ‘pass holders’ to go/do specifically where/what they are authorized to go/do” could be called “least privilege.”

    Notice that ensuring “least privilege” takes some additional planning on the part of the “venue provider.”

    First we authenticate users, then we authorize users to do something. “Least privilege” is attained when users can ONLY do what they NEED to do based on an assessment of their “required duties.”

    Zero Trust

    We come back around to the idea that “security” is a process and not an “end product” with the “new” idea of “zero trust.” ” Well, “new” as in “increased in popularity.”

    Experienced “network security professionals” will often talk about “assuming that the network has been compromised.” This “assumption of breach” is really what “zero trust” is concerned.

    It might sound pessimistic to “assume a network breach” – but it implies that we need to be looking for “intruders” INSIDE the area that we have secured.

    Imagine a “secret agent movie” where the “secret agent” infiltrates the “super villain’s” lair by breaching the perimeter defense, then enters the main house through the roof. Since the “super villain” is having a big party for some reason, out “secret agent” puts on a tuxedo and pretends to be a party guest.

    Of course the super villain’s “henchmen” aren’t looking for intruders INSIDE the mansion that look like party guests – so the “secret agent” is free to collect/gather intelligence about the super villain’s master plan and escape without notice.

    OR to extend the “concert” analogy – the security guards aren’t checking “passes” of individuals within the “VIP area.” If someone steals/impersonates a “VIP pass” then they are free to move around the “VIP area.”

    The simplest method for an “attacker” would be to acquire a “lower access” pass, and then try to get a “higher level” pass

    Again – we start off with good authentication, have established least privilege, and the next step is checking users privileges each time they try to do ANYTHING.

    In the “concert” analogy, the “user pass” grants access to a specific area. BUT we are only checking “user credentials” when they try to move from one area to another. To achieve “zero trust” we need to do all of the above AND we assume that there has been a security breach – so we are checking “passes” on a continual basis.

    This is where the distinction between “authentication and least privilege” and “zero trust” can be hard to perceive.

    e.g. In our concert analogy – imagine that there is a “private bar” in the VIP area. If we ASSUME that a user should have access to the “private bar” because they are in the VIP area, that is NOT “zero trust.” If users have to authenticate themselves each time they go to the private bar – then that could be “zero trust.” We are guarding against the possibility that someone managed to breach the other security measures.

    Eternal vigilance

    If you have heard of “AAA” in regards to security – we have talked about the first two “A’s” (“Authentication”, and “Authorization”).

    Along with all of the above – we also need “auditing.”

    First we authenticate a user, THEN the user gets authorized to do something, and THEN we keep track of what the user does while they are in the system – which is usually called “auditing”.

    Of course what actions we will choose to “audit” requires some planning. If we audit EVERYTHING – then we will be swamped by “ordinary event” data. The “best practice” becomes “auditing” for the “unusual”/failure.

    e.g. if it is “normal” for users to login between the hours of 7:00AM and 6:00PM and we start seeing a lot of “failed login attempts” at 10:00PM – that probably means someone is doing something they shouldn’t.

    Deciding what you need to audit, how to gather the data, and where/when/how to analyze that data is a primary function of (what gets called) “cyber-security.”

    “Security” is always best thought of as a “process” not an “end state.” Something like “zero trust” requires constant authorization of users – ideally against multiple forms of authentication.

    Ideally intruders will be prevented from entering, BUT finding/detecting intrusion becomes essential.

    HOW to specifically achieve any of the above becomes a “it depends” situation requiring in depth analysis. Any plan is better than no planning at all, but the best plan will be tested and re-evaluated on a regular basis — which is obviously beyond the scope of this little story …