New beginnings

TL;DR summary: 2016 largely sucked for Spaf, with 2015 providing a downramp into the suck. 2017 is going to start with a sparkle (despite the awful prospects given by the US elections) because Dr. Pattie has entered stage left. Takeaways: be positive because unexpected things can happen, and don’t hesitate to make friends because they can change your life.

Some of my friends may have noticed a slowdown in my social activities over the last year+. I’ve never been a great correspondent, but this has been unusual. Of course, being in the wilds of Indiana also impedes connecting with people!

The last 18 months have not been especially pleasant for me, personally or professionally. For example, I was ousted from my position at CERIAS by a (now-former) dean for questionable reasons. Rather than do the right thing and overturn the decision, the provost was more concerned about stopping complaints and news reports of the decision; He did make me some promises to help lessen the impact — none of which he has followed through on. I’m now officially “Executive Director Emeritus” although it isn’t clear what that means.

As another example, I didn’t get my long-hoped-for sabbatical because of a bureaucratic snafu. As a result of that, I was assigned (with only a few weeks notice!) co-teaching a 400 student freshman intro course, with no text and some new, untested technology. It went about as poorly as could be expected from all that.

There was more, but I won’t belabor it because I’ve consistently tried to stay positive. Nonetheless, my life has built up a lot of stress and disappointment. It has contributed to a feeling of not really being valued or wanted at my university … or anywhere else… but I continue to try to find some positive outcomes. And they exist. I graduated two wonderful PhD students, Mohammed Almeshekah and Kelley Misata, and I have two more nearing completion. I handed off leadership of USACM to a great colleague, Stu Shapiro. And I was renewed as editor-in-chief of the oldest journal in cyber security, Computers & Security.

I also was very pleasantly surprised at the end of the year by being named as recipient of two major awards — the 2017 IFIP Kristian Beckman Award, and as a Sagamore of the Wabash. (Neither was publicly acknowledged by my department at Purdue, of course.)

Although not professional, the awful election results haven’t helped my mood any. I fear for where the world is heading, especially for my daughter, my nieces and nephews, and my current and former students. A world where ignorance and mendacity are rewarded, and where bigotry and hatred are encouraged, is not the world they (or anyone else) deserve.

Personally, well, that has had setbacks, too. I partially separated my shoulder 18 months back, and it then developed “frozen shoulder syndrome.” As Wikipedia notes (see the link) “Pain is usually constant, worse at night, and with cold weather. Certain movements or bumps can provoke episodes of tremendous pain and cramping.” Uh, yeah. Exactly that. By the way, typing is difficult, too. 6 months of physical therapy brought me back to 90% of normal. And I’ve continued to deal with some of the regular wear and tear associated with many years and miles. I’m not as old as my students think I am, but there are mornings getting out of bed (and climbing flights of stairs) where my body agrees with them more than with the calendar.

That might be enough for most people, but of course, not for me! In June, my divorce with Kathy, my wife of 30 years, was final. It was not hugely surprising in the long view — we have grown in different directions over many years. It was surprising in the timing though, and right while I was trying to cope with many of the things above. However, we don’t get to choose when everything happens in our lives and Kathy decided early in the year that it was time for her, so there we were.

The divorce was largely amicable. After all, working together against life’s various challenges over 30 years does bring a lot of connection, as does being co-parents to a wonderful daughter. Kathy is a complex, remarkable person, and we had a good run together. She has now embarked on a new chapter in life, and I wish her nothing but happiness. But, it was still more stress for me….

However, out of change and chaos, sometimes new possibilities arise.

While all the above was crashing down on me, I had several long-time friends corresponding with me, to encourage me. These are people who I’ve met over the years where we’ve had some connection that has developed into friendship online. We don’t see each other often, but we share experiences, stories, jokes, encouragement, and occasionally provide a virtual “hug.” Their support was really helpful. One in particular had wise words and great humor about how to cope with setbacks, the divorce, and more. She was someone I met nearly a dozen years ago when she and her then-husband were grad students at Purdue. I hadn’t seen her in person in a decade, but we kept in touch online. In the intervening years she had gotten divorced, gone back to school for her PhD, moved halfway across the continent, and gotten a faculty job teaching. She had positive advice that resonated with me, and her love of puns and bad jokes was delightful. (I realize not everyone would say that about puns. Your loss.) We corresponded more and more until we decided it was time to meet again in person and see exactly what might be developing. We did, and we liked each other even more in person than online.


After several more meetings, Pattie spent most of the summer with me in Lafayette, helping me do a top-to-bottom clean-up of the house (I kept it after the divorce). Probably more than a literal ton of items that neither Kathy, Elizabeth nor I wanted was donated to charity, recycled, or simply dumped. I ran across things saved from my parents, my childhood, and family souvenirs from the last few decades. It was an emotionally trying time for me, but Pattie provided advice, humor, and affection. When my shoulder or back complained about the endless boxes, she was there to provide a helping hand and sometimes a wisecrack — a perfect mix of empathy and motivation.

After “Dr. Pattie” went back to teach in Louisiana, we had time apart, and we staged several visits and trips together when we could schedule them. The combination only confirmed for us that our paths should be joined rather than separate. So, Pattie resigned her position at the University of Louisiana Lafayette, and will be moving to West Lafayette, Indiana in late December. (Yes, Lafayette to Lafayette — one of many interesting coincidences.)

Oh, and just to tie up loose ends, we’re going to get married in 2017. We’re both old enough and experienced enough to know that what we have is special, and time is precious.

So, 2017 is going to get off to a really great start for me, and I’m hoping the overall trend stays positive. I hope it will for you, too. Best wishes to you for the holidays, and beyond



Update: Pattie and I got married January 3rd. We picked the date because it is equidistant between our birthdays. Perhaps a nerdy reason, but there it is, and a great way to start off the new year.

Results of the Spaf’s Bow Tie Auction for Charity/Non-profits

The auction closed yesterday.  My sincere thanks to everyone who participated.  I was unsure how much interest it would generate, and somewhat concerned about whether it would generate anything significant for the organizations.  Pleasantly, a number of people responded with generous pledges.

Here are the winning bidders, bids, and destinations for each tie:

  1. Jon Loeliger, $175, the Breast Cancer Resource Center of Austin, TX
  2. Bryn Dole, $150, Purdue University/CERIAS
  3. David Elliott Bell, $300,  Purdue University/CERIAS
  4. David W. Baker, $350,  Purdue University/CERIAS
  5. Henrik Kramshøj, $150, UNICEF
  6. Karen Lopez, $501, Purdue University/CERIAS
  7. Bryn Dole, $150, Purdue University/CERIAS
  8. Aaron Lepold, $150, American Cancer Society
  9. Linda McGlasson, $125, Purdue University/CERIAS
  10. Lynn Terwoerds, $150, UNICEF

Additionally, Paul Rosenzweig pledged $100 to Purdue University/CERIAS.  If that bid had won a tie, he was going to donate it to a worthy grad student.  (Paul is a regular bow tie wearer, too.)

As per the “goodies” offer in the original post, Bryn, David. David, Karen, Linda and Paul will each get a CERIAS challenge coin.   Bryn, David, David and Karen will also receive a CERIAS-logo item.  And Karen will get treated to dinner and a bow tie-tying lesson from me if we manage to determine a shared location sometime before too long.  No one made a $1000+ pledge, so I don’t need to reveal what I had in mind for that. 🙂

Additionally, although I didn’t disclose this in the original post, I made a personal commitment to ensure that all the charities I listed get something out of this.   Therefore, in addition to whatever I may donate at year’s end, I donated (from personal funds) $150 to each of:

Thus, the total amount raised for these organizations from this mini-event comes out to $3051 — and no one was required to dump anything on their heads!

If you would like to toss in a donation as part of this overall effort, please do so!  These are all great groups and worthy of support.  I will honor my “goodies” offers for any donations made through the end of August!  Contact me for details.


Charity Auction — Some of Spaf’s Bow Ties!

Total bids + 6 pledges (no tie):  $3051 — Auction closed!

Read the rest of this entry »

About Me & The Gory Details of My Social Media Presence

Recently, I’ve picked up a lot of new readers/links/friends/stalkers/tails/parasites&symbionts/alien monitors.   I hope it is because people find some of what I am posting to be of interest, as well as the usual infestation of spambots and imaginary beings (about 80% of my followers, I reckon). It is probably time to once again lay out a little about my online presence to help make things clearer to all of you bots (and to help me keep it straight). As it is, you may see multiple versions of me online and question your sanity, instead of spending your time wisely questioning my sanity.  So think of this as a service, to you.

First, About Me

Yes, I am that Spaf, assuming you have heard something about me before.  By day, I am a moderately well-known scientist, professor, and commentator, with a focus on issues of cySpafford_Eugene1_colorber security, privacy, ethics, and national policy, often with a somewhat off-kilter point of view.  You can visit my page for links, or see my (incomplete) Wikipedia page.

The rest of the time (well, all of the time) I alternate between philosophy and humor, with an emphasis on the humor.  Oh, and a certain amount of snark and political commentary.  During election years I tend to be particularly active politically as I am usually appalled with at least one party that is promoting stupidity and bigotry.  Still, I try to point that out with humor, when I can.

And yes, I wear bow ties.  That has been one of my signature items for over 25 years.  And the beard has been there for over 40 years.

A quick summary of many of my social media sites and background is available at

About My Postings

First, I try to maintain three distinct, segregated streams of material in my social media. (You can skip to the links if you don’t want to read the details.)




One stream is more or less related to my “day job” as a professor at Purdue University.  There, I post in a blog on an irregular basis.   I also maintain a Tumblr blog where I repost links from various on-line media about security, privacy, espionage, cybercrime, and related topics.  That blog is gated into a Twitter feed to which I sometimes add related tweets.  Along with all of that, I also sometimes put things into a Facebook group page and a LinkedIn group, both of which are for people interested in CERIAS at Purdue University.

I have a LinkedIn account that I use to maintain professional contact with others. I have profiles at ResearchGate and that I don’t do a good job of maintaining, but may be of value. All of this tends to be serious and professional.   Oh, and what have I done in security?  You can see a partial list of my more noteworthy accomplishments here.


A second stream is more fun oriented, but sometimes serious.  In my WordPress blog I post items of a personal nature — sometimes intended to be funny (such as my New Year’s resolutions) or quirky (such as my history of my branch of the Spafford family) or serious (my 2009 reflections on 9/11).

I maintain an active Twitter account as myself, and a Facebook account.  In both there will be a range of the bizarre and the unusual that make me laugh or shake my head: basically, things that I think are worth seeing.  Readers will also pick out some of my thoughts on politics, posers, organized religion, equal rights, and annoying celebrities (among others); I’m not too reserved about some of my views. The Twitter and Facebook feeds have some cross-connect, but the feed-across is sporadic — if you are constructing a psych profile on me, you should probably follow both.  I also post answers to Quora from time to time, and images to Pinterest.  I maintain a legacy mailing list named web-heads that gates into a Tumblr blog, that then dumps into my Twitter feed with the tag #webheads; anything with that hashtag in my Twitter or Facebook feeds thus may have been posted by someone else on the list who is similarly demented.

None of my posts in any of these outlets should be construed as having any official endorsement or connection with official positions or activities of my employer or organizations with which  I work!  Stated differently, these are my own peculiar views only and I am the only person to blame (well, maybe my family and “The Voices” influenced me). NB: some of these posts may well include items of an adult nature, so beware if you are easily offended.

ACM, etc.

My third collection is not quite out in the open as an independent stream.  I am a long-time member and immediate past chair of the US Public Policy Council of ACM, and a member of the ACM Council. I am involved in activities related to ACM, IEEE, ISSA, AAAS and other professional organizations. You may see posts in some places from me related to those.  In particular, there is a shared USACM Twitter feed to which I sometimes contribute.  Those outlets shouldn’t be viewed as related to either of the first two streams.

More Generally

I do not use Google+ regularly for any of these!  I don’t like their original policies of tying everything to that account, and I don’t like the interface and difficulty of connection to other social media.  In particular, I use some scripts and services to post items across services and at metered “doses” and those don’t work well with Google+. (And yes, I am not overly fond of Facebook’s privacy policies, either, but it is the only mechanism for keeping my semi-sporadic contact with some of my friends.)

BTW, I have a bunch of other accounts that you aren’t likely to see active any time soon — Flickr, YouTube, BuzzFeed, Instagram, and even MySpace, among others.  I set those up simply so there wouldn’t be anyone else sending stuff out as spaf.  Unfortunately, I got to a few too late, plus a few require that usernames be more than 6 characters long.  Thus, Twitter and others have names such as TheRealSpaf as identities.

You may be wondering where I find the time to post all of this stuff.   The answer is “in parts.”  First, I actually am physically limited much of the time: I have some medical issues that sometimes limit my ability to work online.  I thus have less productivity than many of my peers, especially because it becomes more difficult to hit deadlines. Short posts and mouse clicks are much easier for me, so I use Twitter as an outlet.  Second, I have chronic insomnia, so a lot gets shared with a few mouse clicks when I should be asleep (or sedated).  And third, I use several bots and scheduled jobs to meter out material over time rather than the bursty schedule at which I actually use the services.   This is basically a trick from Mother Nature — I use fluff and timing to make myself appear bigger to potential predators, er, the orderlies.  Note that there are likely to be quiet periods where you don’t see much from me: I’m either busy, I’m traveling, or I’ve been abducted by a UFO.  Again.

If you have questions or comments on anything I post, please let me know.   If you want to repost any of the items be sure to use the appropriate mechanism.  In particular, if you want to use material from my blogs then either quote excerpts with appropriate credit, or provide a link back to the original.  That is polite, professional, and legal.

Linking to Others

If I don’t know you and have not interacted with you in some significant way, don’t bother to ask that I “friend” you on Facebook.  As it is, I perhaps need to trim the ones that I have, especially the imaginary ones.  However, you can “follow” my posts if you want to see them — almost all are public.

If you can prove who you are and that there is a reason I should connect with you on LinkedIn, I may.  The threshold is lower there than Facebook, but still non-trivial.  You can ask someone I have as a trusted contact to vouch for you, and that is usually enough if you have a good reason for connecting. Because of my professional work, I get trolled a lot, so I am cautious.


If you try to send me spam, I will report it and block you.   Same general response with things that are intended to insult me, or are full of bigotry or vitriol towards any group not itself devoted to bigotry and/or vitriol.  That doesn’t mean you have to agree with me on everything.   I have many friends and corresponding links where we cannot have a conversation about politics or religion without getting a little spirited.  I value reasoned differences, but don’t expect me to keep quiet with my opinions — and don’t expect me to continue to link to you if you are rude, stupid and/or obnoxious.



Professional Stuff

Personal Stuff



If you are interested in miscellany about me, you can check out:

3 Short Stories About Spaf and Costumes


As I noted in previous weeks in this blog, 15-20 years ago I wrote a regular series of essays, most intended to be humorous. This one was written in the late 1990s about two incidents occurring in 1983 and 1977 — almost prehistory — with a more recent addition from 2000 as a bonus).

Last week, I wrote about being the Easter Bunny. These three are also about costumes…sort of. I have always been willing to do things for a laugh, and am not (usually) too self-conscious. I realize that I am not God’s Gift to Women (well, maybe the Gag Gift), and so looking my best doesn’t matter much, especially consider my “best.” But if I can make people laugh…well, I’ve accomplished something, I guess.

Without further ado, three stories of things that have happened to me in years past.

The Stories

Valentine’s Day 1983

I think it was January of 1983 when this story got started. I was single and looking, in between working on my dissertation (sort of) and teaching at Georgia Tech. A few months earlier, at the suggestion of my advisor, I joined the Atlanta chapter of Mensa. Some chapters of Mensa are very refined and intellectual. The Atlanta group (at least at that time) was quite a bit more social. It attracted a lot of singles (and married people who acted single). It also attracted a lot of witty, funny people. I found it a lot of fun. Plus, I got to expand my circle of acquaintances outside of the people at school.

Shortly after I joined and started going to some of the meetings, two roommates joined: Jodi and Kathy. They both had great senses of humor, were attractive, and single. Kathy started dating one of my friends in the group, and I started hanging out with Jodi (we became good friends but quickly realized we weren’t destined for anything more than that). Jodi and Kathy had friends in the arts scene in Atlanta, so whenever there was some group outing, there were some interesting — and often, attractive — people to meet.

Anyhow, one evening, Jodi and I were talking and having some wine. She got the idea that she and her roommate were going to have a Valentine’s Day party. We kicked the idea around some, and as we had more wine, she decided that it would be a costume party — she’d invite her fine arts friends, and there would be some prizes for best costume. She promised she’d invite some of her single friends for me, and told me to be sure to wear a costume that would get me noticed. In fact, to help me be sure to be able to make an impression, she would let me make an award of my choice for “best woman’s costume.” What a pal! She urged me to be outrageous and provocative with my costume. Well, of course!

I also took this as a challenge. What would I do for a costume that would get me noticed in a crowd of theater people? Over the next few weeks, I thought and thought. Then, one day, I was listening to the radio (and almost certainly drinking a bit too much with Dave, my roommate), when they played Jethro Tull’s Aqualung. I dunno why, but I decided that I would create a costume as a flasher. Dave thought this was a great idea, too (which should have been a significant warning). This would be a variation on


a costume I had tried as an undergraduate (as the strange old man (Tyrone F. Horneigh) from Laugh-In who kept asking if the woman wanted to see his Walnetto). I started designing.

I visited a local novelty store and found a pair of oversize boxer shorts with little cupids and hearts on them. Perfect! I had a T-shirt made with a big heart and the words “Even perverts need love too.” I took an old pair of pants and cut the legs off. I found a coonskin cap and cut it up. I found old gloves and cut the fingers off. I found a flashing button that said “Happy VD!” (All of this seemed appropriate at the time, and no, I wasn’t using drugs).

I was set. I talked to Jodi several times in the weeks following our first conversation, and she told me about the food she was setting up, and the number of people she had invited. I did not mention my costume, as I wanted it to be a surprise. I was psyched!

The big evening came. St. Valentine’s Day: the feast day of the patron saint of lovers and of thieves (there is something deeply symbolic about that, I am sure). I had spent a lot of lonely Valentine’s days, so I was looking forward to this one.

I put on the T-shirt and boxer shorts. I put the flashing button on over my heart. I took the cut-off pant legs, and rubber-banded them on my legs just above the knee. I put on the gloves with the fingers cut off. Then, I strategically pinned the raccoon tail from the hat hanging out the fly of the boxer shorts. I donned the overcoat and went downstairs. With the coat closed, I looked like I was dressed up for a slightly chilly night on the town. But when I flashed open the coat, … well… it looked like I was ready for a night on the town. Dave pronounced the effect as “perfect,” which should provide you with some additional insight why we were roommates. Two of our neighbors also pronounced the costume as “gross” and “fitting, somehow.” They were two ditzy students from the design college in town who had resisted all our advances to date, so I took the fact they had even talked to me as encouragwment. Undaunted by their critique, I picked up my secret weapon — a dozen red roses. I was going to give the roses to whichever fair damsel had the best costume at the party. Then I got in my car and left. Thankfully, I was not stopped by the police on the way to the party.

I arrived at Jodi & Kathy’s place right when the party was supposed to start. There were only one or two cars there, so I wasn’t the first to arrive, but I wasn’t far from it. I decided to make a splash. So, I rang the doorbell. Jodi and Kathy both came to the door. Putting on my best leer, I flashed open the coat.

The effect was more incredible than I had anticipated! I cannot possibly describe the look on their faces, or on the faces of the people behind them. Perhaps the best way to describe it is to explain that once the wine had worn off a month earlier, Jodi had totally forgotten that she had decided it was a costume party. Everyone she had invited had been told to come semi-formal. Except me. Everyone was dressed up…but not like I was. I was the only one without pants and a furry item hanging out of my shorts. In fact, I was the only one with anything hanging out of my clothes. Kathy had never been part of the conversation at all, so she was especially … perplexed. Jodi was shocked. I was….well, I’m not sure there is a word for it. Mortified is a little bit too tame.

Rather than head home to change (or dig a hole for myself in the yard), Jodi insisted I be the official “greeter” at the door. She figured that I’d at least get to meet all the women she had invited to meet me and her other friends (true), that I’d make an impression on them (very true), and that it might make the costume seem a little more planned (impossible). So, I spent the next hour at the door, answering the doorbell, sometimes “flashing.” I decided to give a rose to each woman who smiled at this display. I didn’t give a whole lot away, unfortunately. The whole situation was rather disappointing in many ways, and I spent a lot of time thinking about how really stupid the whole idea was and what a total loser I was.

I also spent much of the party drinking, and trying to get away from this one really odd theater guy who kept following me around and asking “What kind of pervert needs love, too?” An apartment full of single women, and I was not only not dressed for success with them, but I was being hit on by a gay guy who couldn’t take a hint. It was even more depressing than most of my Valentine’s Days.

In leaving, I gave the remaining roses to Kathy and thanked her for the party, and for not being part of the “costume” theme (I secretly thought that Jodi had done it to me as a joke — I still wonder about that). I later learned that my aplomb under the circumstances, and my gift of the roses really impressed her. Perhaps that contributed to her marrying me 18 months later. Or maybe it was the racoon tail. Jodi served as maid of honor at the wedding. She didn’t believe me when I told her it was a “costume wedding.”

To this day, Jodi still claims she doesn’t remember telling me it was a costume party. And I can’t help but get somewhat nostalgic whenever I hear Aqualung. At least, I think that feeling is nostalgia…..

Surprises Can Work Two Ways

When I was 19, my father hurt his back in an accident and was out of work so long he lost his job. My sister was finishing up in high school, and I was having a really mediocre time in my first year in college, so I decided to drop out for a while. The job market at the time was a little tight, and I didn’t exactly have a premier skill set at the time, so I ended up taking a job that had less that desirable qualities. However, it paid regularly and helped keep the family fed. So, I ended up as the assistant manager in a carwash, attached to a car repair place. Many odd and funny things happened there that I may write about some other time.

In this position, I got to do all the lousy jobs that the manager didn’t want to do, and that the hourly employees refused to do. One of those was cleaning out the sump pit. Another was talking to irate and irrational customers (which helped me develop skills I use now in faculty meetings). One of the least desirable jobs like this involved fixing any leaks in the hydraulic lines that ran the brushes. It was a particularly noxious job, because not only did it involve fixing the leak and bleeding the lines of air bubbles, but also cleaning up all the oil that may have leaked or sprayed about. This was not only difficult because the oil tended to penetrate everything — including clothing, hair, shoes, and so on — but it had a particularly high sulfur content. Thus, it smelled awful. And, after cleaning some of it up, so did I. It was impossible to do the job without getting covered in oil.

I had been working at this job for nearly a year and here it was — my 20th birthday. My parents had offered to take me out to dinner when I got home from work at 6pm. The manager was away at a dirt bike race in Arizona, but everything appeared to be going normally….until 4:30. At that point, a hydraulic hose driving one of the big brushes burst, coating all the brushes at one end of the wash with thick, smelly oil. I called my parents to explain that I would have to miss dinner — I had to stay and fix the mess.

This was not the first time I had to carry out this noxious job, so I knew what I needed to do. To prepare myself for the coming ordeal, I closed down the wash, went into the locker room, and changed out of my clothes and into a set of cloth overalls. I put my clothes in a bag in the car and set to work.

I won’t bore you with the details, but I had to test the dang thing three times over the next few hours, and the first two times the leak wasn’t completely fixed and it sprayed me with oil. I had to clean the brushes about a half dozen times with heavy-duty detergent, including “combing” the brushes to make sure the oil was out. (Residual oil in the brushes could strip paint from some cars, so they had to be clean.) By the time I finally finished around 8:30pm, I was covered in oil. It was in my hair, in in my beard, down my sleeves, and in my ears. It had gone down the sleeves and neck of the overalls and had thus spread out in a film over almost my entire body. I decided I was so filthy, I wouldn’t even bother to try to clean up and change there — it would only ruin my clothes. I needed a shower with multiple doses of soap, and there was no way to do that at work, barring an episode of streaking through the wash — which I considered, but the water was too cold. So I put a plastic tarp down on my car seat and drove home.

When I got home, the house was dark. I figured my family had gone out to eat or shop. So, I decided I would simply get my clothes into the washer immediately rather than track the oil throughout the house. Thus, I stripped out of the overalls and rolled them into a tight ball, inside out.There was a lot of oil on my underwear and socks too, so (because the house was dark and empty), I took them off and rolled them into the overalls too. The front hall had a tile floor so I could come back later to wipe up any mark, but this way I wouldn’t drip on the rugs. I wiped off whatever oil I could with the rolled-up clothes. I got most of it, and smeared the rest into interesting patterns.

Stark naked, except for a thin film of hydraulic oil, I went down into the family room on my way to the basement where the washing machine was. I didn’t turn on the lights, because I didn’t want to touch the wall with my oily hands.

So, I got to the foot of the stairs, holding the clothes tightly wadded under one arm, when the lights suddenly went on, blinding me. I heard a bunch of people yell “Happy….birth…day….Surprise!” I was exhausted, dirty, blinded, surprised….and naked. So, I’m not certain who got the most surprise. As best as I can remember, my eventual response: “It certainly is! Could someone please open the basement door?”

Needless to say, the assembled group remembered that birthday. I must say, I certainly do too.

To this day, I don’t particularly like surprise parties, and every time I smell hydraulic oil, I want to make a wish and have some cake.

Linux and Danish TV

In 2000, I got an invitation to speak at a couple of events in Europe in March of that year. One of them was the Danish Open Systems Conference. The others were in England and the Netherlands, and all were related to CERIAS. So, I set up the trip, and talked Andra, our Assistant Director into going along, for three reasons:

  1. They were business-related, and we’d be visiting with some of our consortium partners — and potentially some partner-candidates. Her job was to serve as interface for the consortium;
  2. She has always had a wacky sense of humor and been a good friend, and thus is a pretty great traveling companion.
  3. It would continue to foster gossip back on campus, because people still couldn’t seem to grasp that men and women can be professional colleagues and friends without any hanky or panky involved. (This is an ongoing issue for me as I have tried to mentor some younger female colleagues over the years. Sigh. If people would just think — all of those women are smart and all have better taste than that!)

So, Andra and I headed off for our first (and only) trip to Europe together. Many adventures ensued, including a midnight trip to Stonehenge, some odd experiences (for her) with European breakfasts, a tour of the Tower of London and Harrods, her introduction to mushy peas and draft bitter, a long pub crawl in Amsterdam accompanied the next day by food poisoning (for me) and a shopping spree (for her), and several other adventures.

When we got to Copenhagen, it was really cold and rainy. (I’m told this is usual for Copenhagen.) We decided to stay in at the hotel until it warmed up. This was at the end of the trip and we were both getting a bit bored with travel, as well as homesick and missing our daughters. I had a small suite in the hotel, and we decided to meet there to go over notes, and kill time until the weather got a little better, mainly because the hole-in-the-wall hotel where we were staying had no real lobby.

Thus, after breakfast, we convened around the tiny desk, and went through all the business cards and notes we had collected during the business part of the meeting. After about an hour of that, we looked outside and it was still raining. So, we thought we’d see if there was any kind of weather or English language news on the TV.

Apparently, at that hotel (or maybe Denmark in general?) at 11am there is nothing on TV except hard-core porn. Well, to be fair, there were a couple of Danish-language soap operas, but those also featured nudity and porn. It was…. awkward…flipping through channels. Then it got oddly funny, and we started making snarky comments, until it got too silly and then awkward again, and we shut it off. Total elapsed time: about 4 minutes on the clock, but about 4 hours of awkward.

We quickly agreed that we were going to go out sightseeing rather than sit around the hotel, even if it was cold and rainy, because we really didn’t have any options at that point. So, we went out to do the tourist thing in rain that was on the verge of sleet. We went to the harbor to see the statue of the Little Mermaid (she’s nude), we visited a national museum (many paintings of nudes), and went to see about having dinner at a restaurant recommended by a colleague — with a statue of a nude woman in the lobby. There must be some correlation between that and the fact that it was incredibly cold and wet all the time, because if anyone actually was nude, they’d die of exposure in about 5 minutes! Needless to say, it created a very strange vibe for us, although years afterwards any mention could conjure up some good giggles.

Thankfully, the next day was the conference. We got there, met some people, listened to some talks. Near the end of the day, I gave my keynote talk on Why Open Source Software Only Seems More Secure. Giving a talk like that, to that audience in 2000, was an uncertain proposition, to say the least. I was anticipating a hostile crowd. The title had served to draw a large audience. I suggested that Andra take a seat near a door — no sense in both of us getting burned at the stake as heretics, although given the time spent in the freezing rain that might have been welcomed.

Much to my delight, the talk went over well. The examples I gave, and the reasons for what I had to say were easy to follow and not really possible to refute. (Note that 14 years later we would have the Heartbleed flaw in OpenSSL — among others— that exemplified most of the points I raised in my talk, and have been saying since the late 1990s.) I got some good questions from the audience, and a nice round of applause. They then invited us to join the reception that followed.

Unbeknownst to me, Andra had struck up a conversation with someone to convince them that I didn’t hate Linux. This evolved into some form of bet, and from there I am unsure, but it resulted in me donning a Tux outfit so that I could actually get any food and beer. My picture apparently adorned their website for several years thereafter, and I had to plot revenge against Andra for some later time.

The next morning, we got an early flight home to the US. Thankfully, the airline didn’t show porn on the inflight screens, they didn’t serve mushy peas with the meal, and I didn’t get food poisoning for several years to come. Not too long thereafter, Andra married her guy friend and moved to Florida. But every time I see a penguin or a jar of Danish Crisco, I think of her.

Meanwhile, in the CERIAS blog…

I just posted an item in the CERIAS blog that has some relation to my personal ideas that I post here. Entitled “If you are bored or morbidly curious,” it is a post about the computer history effort at the Charles Babbage Institute. More specifically, it is about the oral history interview they did with me.

So, check out that post if you are into that kind of thing… especially if you are bored or morbidly curious. 🙂

Invitations and Disinvitations

Decision Procedures

I regularly get invitations to speak at various events. This seems to be from a combination of factors: I often have something interesting to say to even nontechnical audiences; my name is somewhat familiar to a (small) segment of the computing community; and unlike many computer people, I don’t talk to my shoes and say “like” and “um” as every other word. Depending on the event and audience, I suppose I am a better choice than a politician (lots fewer lies) or a Turing Award winner (lots fewer theorems). It’s been years since I’ve been booed off the stage, I almost always remember to wear pants, and although I can’t immediately think of any venue where I’ve been invited back, at least there are no outstanding warrants …that I know about. Thus, I’m probably a safe bet as a speaker.

Sometimes there are too many such invitations coming in. I don’t want to say “no” to too many, because of something someone notable once told me, as a parable, in confidence (his identify, that is):

There’s the old story of the village idiot. Whenever people would come to town, they’d be told stories about the guy. They were encouraged to prove it to themselves. The were told to offer him a nickel and a dime (this was many, many years ago, when those were really worth something). The idiot would consider, then pick the nickel because it was bigger.

So, one day, a passing stranger heard this story while at the diner. His next stop after the diner was already planned to be at the general store where the village idiot sat outside during the day. The visitor did as had been suggested, and offered the kid a nickel in one hand, and a dime in the other. The kid looked at one, then the other, then said “That one’s bigger!” and pocketed the nickel. The stranger, being a kindly sort, asked the kid “Do you know the little one is worth twice the big one?”

The village idiot looked around to make sure no one else was in earshot, then in a whisper said “How long do you think people would continue to offer me money if I started taking the dimes?”

So, this person — a notable leader in the field — said, if I said “no” too often, people would stop asking. (Yes, in retrospect, the parable doesn’t quite have the same meaning, but I got the point as I think we were at a bar at the time so lots of things made sense.) And on the chance someone actually might pay attention to what I have to say (there must be at least one every few years), I try not to say “no” all the time.

When I am inclined to say yes, I try to prioritize my choices, and thus don’t say “yes” to all of the invitations I receive. For instance, I don’t want to miss special family events. I don’t want to miss classes I’m teaching and important university events. I try to give priority to CERIAS partners, charitable non-profits, and some government agencies. I expect most commercial entities to come up with a speaker’s fee if they are making money off the event where I am asked to appear, and a large fee bumps up my interest (hey — I’m a professor at a state university with a kid in college). And I give a bump in priority for requests from old friends and past students (who are often old friends now).

This whole decision procedure gets more complex when I am asked far in advance to speak, because I may say yes to one thing and then something else will pop up that I really want to do that overlaps or abuts what I already have scheduled. I don’t back out of things unless it is really critical — I try in all things to keep my word. The result is that sometimes — especially in the autumn — I find myself doing too much travel, and it is very tiring. I need to refine my system so I say “no” a little more often.

Autumn Invitations

This year, I got invited to speak at a bunch of conferences and special events, many of which I added to my schedule — the ISSA International Conference, a special educational event at the USNA, a tech conference at Northrop-Grumman, and more. I was also asked by old friends/students to speak at two different conferences held in Asia. After considerable thought, I said yes to both, especially as both were willing to cover roundtrip expenses in business class. Plus, both seemed to be high-profile, multi-national events. However, each would require a very long trip, with associated jet lag, and each would be for only two days at the destination. On balance, I decided I would do them.

As conference #1 approached, I made all my arrangements. It was a major conference, with government and technical people from several continents — not really a tech conference at all. No agenda for this year was online, but when I saw the list of example speakers from prior years, I really felt honored to have been asked to speak.

Then, a few weeks before I was scheduled to depart, I found the agenda finally on-line and discovered that my “talk” was actually a panel appearance. I’d get to talk for 10 minutes then sit and maybe have a few questions asked of me. 23 hours one-way transit for that. Ouch. However, I had agreed to go, and I wasn’t going to go back on my word.

It turns out that there had been a language problem and things weren’t quite so bleak. My hosts had also arranged an extended visit with a leading tech firm for the day before the conference. I was treated to several 1st-rate meals, an offer of guided sight-seeing, and some souvenir shopping. The panel was short but there were other meetings, and in the end the whole experience turned out to be okay, although still very wearing because of the travel, time changes, and the like. Oh, and the frequent flier mileage put me well over Platinum status for the next year. So, it wasn’t a complete disaster, although had I known when asked, I might well have said “no.”

Whew! I sure dodged a bullet there! But who could possibly be inconsiderate enough to invite someone to travel 20+ hours one-way simply to speak for 10-15 minutes? Ha ha, I had a good laugh that I even thought that to be the case.

Meanwhile, conference #2 was shaping up. I already had the plane ticket (they purchased it). I had roughed out a talk that I suspected would be of great interest — about malware and its rise; companies in their region had some recent, high-profile losses to malware. Also, the conference would be in mid-November, 25 years plus a few days after the Internet Worm, so the timing would be great, too.

Then, about 2 weeks ago, I got email that they wanted my Powerpoint slides in advance, and “reminding” me that — wait for it — I would have about 15 minutes to speak. What the ???? I replied that (a) no one had told me it was only 15 minutes, (b) the talk I had prepared would not fit in 15 minutes so I needed some guidance as to what they wanted instead, and (c) I don’t use Powerpoint.   

I also indicated to a colleague who was involved with the event that I was seriously weighing whether to go — having just been through that experience with Conference #1, and finding long trips unduly wearing (I’m not as young as I used to be, but who is?). He replied that “everyone” was really looking forward to seeing me, and it had been heavily advertised that I would be there. But no one else replied to my (a, b, c).


Tonight, what I got from that same colleague is that I was being disinvited from the conference because I had not responded and they had to print the program. Huh? Responded to .. what? Send slides I told them I don’t use for a talk I couldn’t give? I now have a nagging suspicion that the only reason I had been invited in the first place was to add some “marquee” value to the advertising — not the first time that kind of thing has happened. It really can’t have been to hear what I had to say on any topic, other than maybe “The hotel is nice” or “Gee, it sure is sunny here.” Anything more technical and deep would require non-trivial time to present.

Lucky for me, they paid for the ticket, so I don’t have to do anything to back all this out, and I’m not on the hook financially. I think I’ll use those now-free days to catch up on some reading and paperwork at home rather than at 35,000 ft.

So as of today, I have a new decision rule when being asked to speak: if it is for an event I wouldn’t attend on my own, and it takes me longer than 4 hours to get there, I’m not agreeing to only appear as part of a panel unless it is really, really a special occasion. My life is too complicated already. And really — look at my blog posts. Do you really think I am able to speak for only 15 minutes on a topic? 🙂

Some Thoughts on Lifetime Achievement

Earlier today I was awarded a Lifetime Achievement award from SANS during one of our regular CERIAS faculty receptions. I certainly am honored by this, given the many wonderful things that SANS does to educate and support the information security and response community. I was especially honored to have Lance Spitzner travel to Purdue to present the award oh behalf of SANS, and to have several other people from the community and Purdue show up for the event.

Getting the award

Lance giving the award to Spaf

Over the last two or three years I have received a few awards that could be considered as “lifetime achievement” awards in one way or another. They are certainly not given more than once, and they are considered to represent a career’s worth of accomplishment. I’m not going to argue that I have, indeed, done a few things worthy of note, although I would be the first to admit that I have had great collaborators and partners along the way. And I have the gray hair and scars to prove I’ve been at this more than a few years. The point that troubles me a bit is … “lifetime”? Am I really at such an advanced stage of senescence? Is the end that close at hand? My next birthday approaches apace, and I now wonder if I should worry about reaching it! I’ve been getting AARP solicitations in the mail for a few years, so perhaps this is another sign I should get my affairs in order?

I went to the RSA conference last month and two people who were former undergrad students of mine took me out for meals. It was very pleasant to talk to them and catch up on their activities. Both have started companies and done things to change the world. And both were undergrad students of mine 21 years ago — that’s about half their current ages! But as we talked I realized that some of the big problems I taught them about are still problems today…that issues I was warning governmental agencies and companies were coming, did, and are still here. There’s a sense of being frozen in that era and yet, here are people giving me “lifetime achievement” awards and making jokes about my age and gray beard, and the problems I started my career addressing haven’t really progressed.

Well, that isn’t true: many of those problems have gotten worse. 😦

Maybe it isn’t a sign of decrepitude that I am getting these honors. Maybe these are subtle hints to get the hell out of the way so the youngsters can get the corner office? Well, that isn’t going to work. Yet. I still have a little bit of fire left, and with some luck (and the discounts from the AARP) I might yet make a dent in some of the big problems. I know there are several people who would like me to retire (including some of my faculty colleagues at Purdue) but I really enjoy working with students. Every time I hear from former students about some success, I know that I had a tiny bit of contribution in that somewhere back in time, and that’s a good feeling.

100 years from now, the awards will be forgotten, and I will be too. But I know that the world will be a better place because of the students I have worked with, and have yet to work with. That may sound a bit corny, but in truth, it’s why I’ve been doing this for 24 years – and am not about to stop. That good feeling is the real lifetime achievement award, and anyone who has really connected with students knows exactly what I mean. That is why the SANS award means something special, too – it is decided by people who teach in the the same field.

My thanks to SANS, and to everyone who showed up for the ceremony today for the honor, and for your support of what we are all trying to do.

About me.

%d bloggers like this: