• About
  • Jerry’s Story

swalchemist

swalchemist

Monthly Archives: July 2016

Jerry’s Story: An aspiring auto mechanic changes course

24 Sunday Jul 2016

Posted by Danny R. Faught in Jerry's story

≈ 2 Comments

Part 1 of my telling of Jerry Weinberg’s story was Jerry’s Story: First interactions, where he had started his college studies in September of 1950. But let’s go back to the summer of 1950, when Jerry had no plans to attend college at all.

Jerry had graduated from Omaha Central High School, and he felt disgusted with school. He found many of the subjects in high school to be trivial, so he had skipped most of those classes and still got good grades. He did enjoy a few classes, however, especially auto shop. He told me “I just loved cars, driving them, working on them, even washing them—plus doing body work and painting in my father’s shop. I never really had any other career idea than working with cars in some way.” Though he was fascinated with computers, there were so few jobs available to work with them at the time (and none that he was aware of) that he didn’t even consider a computer job a viable option.

After graduating from Central High, Jerry applied for a job as a mechanic. The owner of the garage offering the mechanic job, however, wouldn’t let him start until after the next school term started. He suspected that Jerry was just looking for a summer job, but he really wanted a long-term employee. Jerry decided to wait out the summer so he could get that job, and in the interim, he worked as a summer camp counselor for a camp sponsored by the Omaha Jewish Community Center. At the camp, another counselor encouraged him to go to college so he could meet young women. Jerry had a keen interest in women, and hadn’t before considered this particular benefit of the college experience. So he determined to go to college instead of taking the mechanic job.

A few days before classes started in the Fall, Jerry showed up at the University of Nebraska in Lincoln to register. The counselors were not happy that he hadn’t registered in advance, but because he had graduated from a Nebraska high school, state law required that they admit him. The counselors were even less happy to find that they had to give him a scholarship because he had graduated in the top ten percent of his class. So he began his studies.

While at the university, Jerry got a job in the Physics department—the job title was “computer.” It turned out that Jerry would be a computer years before he programmed one. He used a Friden electromechanical calculator along with pencil, paper, and eraser to invert 10 by 10 matrices for faculty members. Just as a computing device doesn’t know the ultimate reason it does its work, he doesn’t recall ever knowing why they wanted the inverted matrices. Jerry told me about what he learned from this job:

I recall that it took me upwards of an hour to invert a 10 × 10, and of course the inversion time tends to grow as the square of the size. Going to 11 × 11 would have raised my computation time by over 20%, and increased my chance of making an error somewhere along the line. That was the first time I became aware of non-linear computation times and also the significance of error. It was a good start to my career: my understanding of these factors, which many programmers today don’t seem to appreciate.

He also offered his services as a tutor for any subject, primarily for failing athletes, and he worked grading English papers. He was a Physics teaching assistant and was told he was the first undergrad to get that job, at the ripe old age of 17.

Jerry was out sick with Crohn’s disease for most of his second year. He went home to Omaha to recover. While there, he took a few courses at the University of Omaha (now known as the University of Nebraska Omaha), including Mathematics of Finance. He thought that computers would be used in course, but he had no such luck. There was most likely no computer on campus at all.

When the course progressed to more advanced subjects like probability, statistics, and risk, Jerry found out he knew more about them that the professor did, so he helped teach the class. This impressed the instructor, who was an associate of Warren Buffet. The professor recommended that Jerry meet Buffet because he was seeking bright math students to work with. Jerry wasn’t able to arrange a meeting, however, because he had to return to the hospital for surgery.

During his stay in Omaha, Jerry did manage to meet with the chief actuary at Mutual of Omaha. Jerry was impressed with the luxurious office, but not impressed with the actuary job itself.

He returned to the University of Nebraska and completed his Bachelor of Science degree, magna cum laude and with honors, for four majors: Physics, Math, Philosophy, and English. He then moved to California to study Physics at the University of California, Berkeley. A year later, he had passed his comprehensive exam, finished his thesis experiments, and was on track to earn a PhD in record time. He had a few months of work left to finish writing up his thesis when he found the opportunity he had been looking for since he was 11 years old.

Jerry was out of cash, and supporting a wife and a child, with the second child on the way. He read an ad in Physics Today from IBM looking for applied science representatives. It didn’t say that the job involved computers, though there was a picture of a roomful of data processing equipment. It’s not the first computer-related job ad that Physics Today ran, but it was the first that he noticed. He had no doubt that this was what he wanted to pursue. He wrote to IBM to apply, interviewed in Oakland, and was offered a job on the spot. He also interviewed at Boeing and got an offer for more than twice what IBM offered, but the job did not involve computers.

Accepting either job would mean not finishing his PhD. Jerry says “The degrees were irrelevant to me, but came along as a side effect of my hanging around. My advisor actually cried when I told him I was leaving.” He received a Master’s degree in Physics from UC Berkeley as a consolation prize. Jerry was hired for his dream job as an applied science representative at IBM on June 1, 1956.

I’m sure that Jerry would have found a way to play with computers before long, even if it weren’t for that wary garage owner, the fortuitous advice from his fellow camp counselor, or the worry about paying his family’s expenses. But I was fascinated to see the path that he took to realize his dream.

An excerpt from the ad in Physics Today, which ran in the January 1956 and March 1956 issues. You can see a full scan of a very similar ad from the February 1956 issue of Scientific American.

physics-today-ibm-ad

Can you help to provide additional details from your own knowledge of this era or from your interactions with Jerry? Please comment here or contact me on Twitter.

The next installment in this series is Jerry’s Story: Jerry, the Real Programmer. Also, there is a home page for Jerry’s Story.

A bit of advocacy helps to earn a bug bounty

17 Sunday Jul 2016

Posted by Danny R. Faught in security, testing

≈ Leave a comment

I have been working on honing my security testing skills. I asked Don Ankney‘s advice on how to do this, and one of his suggestions was to participate in bug bounty programs. Many companies encourage security researchers to report security vulnerabilities to them, and in some cases, they offer monetary rewards to the first person who reports each one.

My first bug bounty report for Instagram, which wasn’t accepted, was discussed here: “Username Enumeration – Ho, Hum!” This time, though, I was more successful. I found that none of Instagram’s cookies on its web interface had the “secure” flag set, including the session cookie that identifies a logged-in user. Like username enumeration, the secure flag on the cookies is another “ho, hum” thing often excluded from bug bounty programs. But the Facebook Bug Bounty Program (which also covers Instagram) doesn’t mention such an exclusion, so I decided to report the vulnerability.

I spent some time crafting an attack scenario. I found that the attack didn’t work if I used “instagram.com” instead of “www.instagram.com.” I found that if the insecure page http://instagram.com was in the browser cache, the browser used the cached page and then there was no vulnerability. And for reasons I haven’t figured out, I was not able to complete the attack successfully if the victim was using Firefox. I was able to prove that hijacking an Instagram session was a simple matter of setting just the captured sessionid cookie. This is the bug report I sent:

Description and Impact

The secure flag is not set on any of Instagram’s cookies, including sessionid. When a user with an active session types “www.instagram.com” in their browser to go to the site, they will first hit the insecure site and transmit all of their cookies in the clear. An attacker monitoring their network packets will be able to hijack their session easily. Assuming there is no need to send cookies in the clear at any point, this is easily fixed by setting the secure flag in the cookies.

Reproduction Instructions / Proof of Concept

I implemented a proof of concept using Safari 8.0.8 on Mac OS 10.10.5 and Chrome 49 on Windows Vista Home Basic for the victim. I haven’t been able to reproduce it yet with Firefox.

  1. Make sure you’re not logged in to Instagram. Clear the browser cache.
  2. Go to https://www.instagram.com.
  3. Click “Log in with Facebook”, and enter valid Facebook login credentials. This logs you in to Instagram.
  4. …an arbitrary amount of time may pass, as long as the Instagram session is still valid when continuing.
  5. Go to a public network that someone is snooping on.
  6. Open a tab in the same browser as before and go to http://www.instagram.com (not https). The sessionid cookie is sent in the clear and has been captured by the attacker. Even though the server returns a 301 redirect to a secure site, the cookie has already been sent in the clear.
  7. Attacker hijacks the Instagram session by setting the sessionid cookie in their browser.

I got a reply five days later, saying “This is currently intentional behavior in our product…” I wasn’t surprised that another “ho, hum” bug was rejected, but I was surprised that they considered it a feature. So I replied, saying that I intended to publicly disclose the issue (which is standard practice after the report is closed, whether fixed or not) and I asked for further information about how the site needs this behavior in order to function, to inform my continued testing. I call this sort of response my “Just one more thing” reply, inspired by the TV character Columbo. This sort of followup is routine for professional software testers, but I don’t know how many security penetration testers put bug advocacy skills to use.

The next reply came quickly, saying that though many people had already reported this issue, they would go ahead and discuss the issue with the product team and try to fix it. And lo and behold, about three weeks later, I got notice that the issue is resolved, and I was pleasantly surprised to hear that they offered to pay me a bug bounty. The reasoning was fascinating – the site previously used http (I’m not clear how long ago) and then later switched to https. All the previous reports about this issue had been when they used http, which is silly, since in that case the secure flag would render the cookies invisible to the server. This explains their earlier pat rejection of bug reports about the secure flag, even though that response had become obsolete with the change to https.

They determined that I was the first to report the vulnerability since they switched to https, and so I qualified for the bounty. I am impressed with the amount of care that Facebook/Instagram took in handling this report. I’m eager now to dig deeper and apply more of my bug advocacy skills if necessary.

 

 

Jerry’s Story: First interactions

08 Friday Jul 2016

Posted by Danny R. Faught in Jerry's story

≈ 9 Comments

My friend Jerry Weinberg was present at the dawn of the age of computers. He can describe first-hand what that was like, but much of his story has never been told. I have started to collect Jerry’s stories. Here is a small sampling, which I prompted by asking him “What were your first interactions with a computing device?”

The first thing that Jerry used that we could call a computing device is a slide rule that his father, Harry, gave him when he was about 7 years old. Harry worked for more than 20 years helping to improve processes at Sears, Roebuck & Co. He bought slide rules in quantity to give to the young ladies who computed customer bills. They used slide rules to check their multiplication, for example, when multiplying price times quantity. This practice caught an enormous number of errors before the bills were sent to customers.

Jerry had a more interesting use for his slide rule, though. He was a sports fan, so he used the slide rule to compute baseball batting averages. Jerry says “It’s the easiest thing in the world. A 7-year old could do it.” He still has that slide rule.

Jerry slide rule

He has a “UNIQUE” brand slide rule, made in England. Jerry describes it as small and cheap, with a table of “Trigonometric Ratios” on the back, which he didn’t understand how to use when he started using the slide rule. Later, though, he remembers using tables of sines, cosines, and logarithms, which could also be considered computing devices of a sort. He used the tables in math classes and also for experimenting with numbers for fun.

Jerry remembers his first introduction to the concept of computers being a Time magazine article. This may have been “Science: A Machine that Thinks,” in the July 23, 1945 issue, when he was 11 years old. That article discusses Dr. Vannevar Bush’s “memex,” a conceptual idea of a machine that stores facts for easy recall, which the Time article refers to as a “brain robot.”

The first book that Jerry read about computers was Giant Brains, or Machines That Think, by Edmund C. Berkeley, published in 1949. This book had a strong influence on Jerry, and he considers Berkeley one of his heroes. Much later, he met Berkeley and had long conversations with him, and he was delighted to know that Jerry had been inspired by his book.

Jerry may also have seen “Science: The Thinking Machine,” the landmark Time cover story on January 23, 1950, when he was 16 years old. The cover artist for that issue, as it was for many issues of Time, was Boris Artzybasheff, which is a detail that Jerry still recalls. The article discussed the Harvard Mark I named “Bessie” (which coincidentally is also Jerry’s mother’s name). This was an electromechanical computer that had been in operation since 1944. The article also discussed the Harvard Mark III, a hybrid electronic/electromechanical computer produced in 1950 and it went into detail comparing computers to the human brain.

Jerry was an avid reader. He explained just how avid: “I usually had breakfast alone, with cereal, so there was the box to read. I’m not saying it was my preferred reading, but just that I read everything that appeared in front of me. Like the see-food diet: I see food, I eat it. So, I see print, I read it.” He probably heard about computers from other sources during his youth. He remembers sitting at his father’s feet as his father read the newspaper and offered his commentary on a wide array of topics.

Jerry had been labeled as a “brainy” kid, and he yearned to learn more about brains, especially these “giant brains.” Early on knew he wanted his life’s work to be with computers. He didn’t yet know anyone who had ever seen a computer, let alone used one. He watched and waited for signs of a computer, but went all through high school without seeing one, with perhaps one exception. He had a summer night job in a large bakery computing recipe requirements for the following day’s orders. He used a Monroe adding machine.

When he entered college at age 16, Jerry told his counselors that he wanted to work with computers, but none of them knew anything about computers except that they had something to do with electrical engineering and physics. They decided he should major in physics because he was good at math, which they thought would be wasted in electrical engineering.

One day, Jerry saw a notice for a brief “computing course” using Monroe adding machines, given by the Monroe company. He already knew most of the material better than the instructor. He passed, earning a certificate that he’s lost somewhere along the way. It’s the only computing course he ever took, and the only “degree” in computing that he ever earned.

If you’re interested in hearing more of Jerry’s story, please let me know. He has much to tell. Note that many of the words above are his, and I decided to tell the story in third-person. Consider it a collaboration.

The next installment in this series is Jerry’s Story: An aspiring auto mechanic changes course. Also, here is the home page for Jerry’s Story.

Recent Posts

  • Seeking the Inner Ring – Revisited
  • Use Your Unit Tests, or Else
  • Open-Minded Networking
  • Design Evolutions Doomed to Never Finish
  • Adventures in Personal Library Management

Recent Comments

Danny R. Faught's avatarDanny R. Faught on Seeking the Inner Ring –…
coutré's avatarcoutré on Seeking the Inner Ring –…
Danny R. Faught's avatarDanny R. Faught on Use Your Unit Tests, or E…
coutré's avatarcoutré on Use Your Unit Tests, or E…
Five for Friday… on Four Years after the 343

Archives

  • October 2025
  • September 2025
  • March 2025
  • August 2024
  • July 2024
  • June 2024
  • May 2024
  • March 2024
  • February 2024
  • February 2022
  • September 2021
  • August 2020
  • July 2020
  • February 2019
  • December 2018
  • October 2018
  • August 2018
  • June 2018
  • March 2018
  • February 2018
  • October 2017
  • September 2017
  • May 2017
  • August 2016
  • July 2016
  • June 2016
  • May 2016
  • September 2013
  • August 2013
  • November 2006
  • April 2003

Categories

  • archive
  • career
  • Jerry's story
  • life
  • security
  • software-development
  • technology
  • testing
  • travel

Meta

  • Create account
  • Log in
  • Entries feed
  • Comments feed
  • WordPress.com

Blog at WordPress.com.

  • Subscribe Subscribed
    • swalchemist
    • Join 26 other subscribers
    • Already have a WordPress.com account? Log in now.
    • swalchemist
    • Subscribe Subscribed
    • Sign up
    • Log in
    • Report this content
    • View site in Reader
    • Manage subscriptions
    • Collapse this bar
 

Loading Comments...