Sunday, October 22, 2017

SexyCyborg: Causing Continual Cultural Conflict

I want to talk a bit about Naomi Wu, a Shenzhen freelance programmer, a Maker, a model and a vlogger, who added an enormous pair of 800 ml breast implants to her already abundant good looks and then established her YouTube persona as SexyCyborg.

When appearing in public, she often wears the tiniest of nano-shorts and a crop-top revealing a slice of under-boob.  At pool parties, her bikini consists of little more than strings.

Naomi is intentionally stirring the interfaces between Makers, engineers, culture, sexism and more.  She has many goals in her life, but the one that fascinates me most is her goal to level the playing field for everyone, female and male, young and old, newbie and expert, both as Makers and in life in general.

I support her on Patreon, and I want to be clear about the reasons why.
  1. She's a female Maker pushing her way into a global phenomenon still dominated by white Western sexist male culture.
  2. She's a talented self-taught Maker who works in multiple areas, from software, to 3D design and printing, to wearables, to work tables and shelves.
  3. She's a Maker on the inside of the Great Chinese Firewall.
Certainly, the above characteristics alone are worthy of support.  The fact that Naomi is also the SexyCyborg really has relevance to only two items in the above list: Maker sex discrimination and her wearables.

There is one enormously important item missing the above list:
  1. Inspiring Makers of all ages, especially female Makers, to pursue their interests despite gender-based or age-based resistance.
This is actually what I most want to support, and would most like to see succeed on a global basis.



I'm making it sound like it's all about Naomi Wu, SexyCyborg.  It isn't.  It's also about me.  It's about how I view Makers and how I view women, and how confused I used to get when both appeared in a single package.

I always thought of myself as an unbiased person, free from common prejudice.  But Naomi arrived like a stick in my eye, jumbling my perceptions, causing me to uncomfortably flip between "Wow, cool Maker" and "Wow, hot woman" as if they were two different things.

I can't count the times Naomi has made very clear the differences between how people in Shenzhen respond to her appearance compared to Western males.  The charming videos with kids and "Aunties" were one thing, but the lack of drooling, leering looks from Shenzhen males when she walked in public finally made the point clear to me.  The only leering looks I can recall in any of her videos came primarily from the Western expats at her pool party modeling gigs.

So, what's the difference between Shenzhen men and Western men?  Is there a difference I can find, understand, learn from, and put to good use?  Well, I'm far from Shenzhen, and don't speak either Mandarin or Cantonese, so direct research is difficult.  I started by rewatching Naomi's videos, and well as videos by other Asian vloggers, both locals and expats.

I was most impressed with the videos by Western expats who had chosen to live in China long-term; had built a career; had married a local; had started a family.  How their videos changed from the earliest to the most recent.  And how they and their spouses reacted during trips to the West.

Then I viewed Naomi's videos again, especially her 360 videos, where I could look at all the folks around her.  I noticed how she got about as many looks from Chinese women as she did from Chinese men, and for about the same brief length of time, with no major facial reaction other than, at most, a small smile, never a frown.  Many of the expats had the same behavior, though there were several very obvious exceptions who stared and leered, turning their bodies when their necks reached a limit.

After a while I finally started to understand something. Perhaps it's not the full picture, but I think Chinese and Americans view beauty, especially female beauty, in very different ways.  It may come down to the perception of beauty itself.

For example, to a Westerner, a beautiful building, a beautiful garden, a beautiful song, and a beautiful woman are likely thought of as representing distinctly different kinds of beauty.  To the Chinese, I believe they are seen as parts of a continuous whole, free of sharp distinctions, sharing more commonality than differences.

Western males judge women according to their perceived beauty, attributing to them attributes that are unrelated to appearance, such as personality or intelligence.  Western women are not immune to similar judgments concerning each other and men.

I believe the Chinese view physical attributes as simply a means to recognize someone from a distance, and not as a representation of who they "are".  The Chinese also view identity a bit differently, not residing entirely within the individual, but also being diffused into family, friends, associates and even society.  To get to know someone in China I believe it must be just as important to spend time with others who know them in addition to individual time.

I believe it does come down to identity, both its definition and perception, particularly in how and when appearance becomes a factor.  And, perhaps, how there is an intentional Chinese cultural emphasis on similarities over differences.

China is a communist country, a "People's Republic", that has been undergoing great social and economic upheavals over the past 40 years, causing stresses that, after a period of easing, now push the government to become more authoritarian, with increasingly invasive public and private monitoring.  The underlying ethos was and is: "we are all in this together, and must work for the common good".

China is also a region with a long dynastic history massively dominated by the Han culture and race.  In China, all of the non-Han taken together are a surprisingly small part of the population (under 10% of the total), with explicit government policies having the goal to absorb and diffuse formerly separate races and cultures into the Han-dominated society.  An example of this is the ongoing government-supported Han migration into Tibet.

Taken together, these factors provide a context that encourages specific social traits, especially among the overwhelming Han majority.  While Westerners may view some some of these traits with disdain, the simple fact is that equality is much more a default assumption within China, particularly among the Han.  And I'm saying "more equal", not "totally equal": China still has many cultural stereotypes related to sex, age, and particularly race, but they are much less noticeable than the equivalent Western traits.

I believe this Chinese equality particularly extends to sexism and judgments based on appearance.  For example, personal style is both accepted and appreciated in China, but not judged by its absence or extremeness. My perception is that fashion and style are much more about expression and entertainment rather than anything about identity.

A Western comparison may be our taste in music:  We sometimes want to listen to Jazz, other times Pop, but our favorite may be Country.  We seldom judge people by what they are listening to in the moment or by their general music tastes, at least not in any way close to how we judge people based on their appearance.

So, I've chosen to try to view the external physical beauty of people more like how I suspect the Chinese do, more like a beautiful song or flower, rather than something that should inflame my hormones.

And it's working!

But I must admit I did have a bit of a head start:  Decades ago I was a semi-pro photographer (which means I took gigs only when I wanted a new piece of equipment).  As a photographer, I saw whatever was in the viewfinder as part of the picture, something to be properly framed, lighted, and composed.  This applied equally to people, places and objects.  I was photographing beautiful things, but it was more about the beauty they shared, and abstract beauty.  I took particular joy in revealing the beauty in things often not thought of as beautiful.

I gave up photography because I had let the camera isolate me from life on the other side of the lens.  I had become increasingly shy in social situations.  Things get quite bad before I realized there was a problem, getting to the point where I rarely when anywhere without my camera.  I quit cold-turkey, which helped immediately, but only decades later did I realize I had also given up the equality of the viewfinder.

The more I try to see "beauty as beauty", the more I see the world as potential photographs.

When I see images of Naomi in minimal clothes, I find I now look first to see if a Maker project is also in the image.  Because that is who Naomi is to me.  See the list at the beginning of this post.

Don't get me wrong: I don't appreciate Naomi's physical beauty any less than I did before!  I now appreciate it as part of the beauty of the greater whole; the Maker, the programmer, the model, and the many other attributes of Naomi Wu, SexyCyborg.

I also view those around me differently.  I like having less of a Pavlovian response to attractive women, less being shy and tongue-tied in their presence, more interested in the rest of who they are.  Most notably, this affects how I interact with female bar and restaurant staff, whom I now seem to adopt as sisters independent of their attractiveness.

And, finally, I must admit to the changes being ongoing and incomplete.  For example, I have come to fully understand just how rude it is to openly stare at people.  So I now do it covertly, behind sunglasses, from the corner of my eye, with my nose pointed straight ahead, with my face neutral.

My journey may not yet be complete, but I can at least try to act as though I'm further along the path.  As most Shenzhen folks do.

One day, one step, one person at a time.

Saturday, October 21, 2017

Cybersecurity *IS* "Defense in Depth".

I'm not any kind of security expert.  I'm just a real-time/embedded instrumentation developer who needs, from a security perspective, to Lock Shit Down.

No matter how much you know about your hardware and software, you really know very little of use until you get down to "Formal Proofs of Correctness" for all parts of the system.  Which are scarce, to say the least, presently limited to academic exercises or special-case military-type implementations.

When I came across anything that could use a network to affect the boot process, I'd ask IT to firewall it in our routers (in case the on-system configuration of that capability failed or was overridden), and write a test to show that the firewall was at least trivially working to meet that need (which the customer would also run to help ensure system security).

Then we came across firewall vendors who explicitly prevented closing such channels, or didn't explicitly show they were open.  We needed to assume our external firewalls would lie to us.

So I started preparing for "Defense in Depth", to have a series of simple firewalls present at every opportunity that wouldn't destroy latency or throughput (such as within network interface hardware and drivers). This worked well enough when on a wired interface, but proved inadequate when our systems started supporting wireless interfaces.

I finally had to move my embedded applications into VMs (at a significant increase in platform hardware cost), and implement firewalls at every opportunity both within the VM and between the VM and the host OS/hypervisor.

All these firewalls primarily concerned blocking traffic that wasn't related to the instrument functionality itself, traffic that was out-of-band relative to the application.  To keep things small and fast, we avoided stateful firewalls.

As the platform hardware capabilities grew (to multicore ARM), we shifted from tiny "secure" RTOSes to Embedded Linux, which meant we also needed to address hundreds of CVEs on our platform if we wanted to sell into certain markets.  This pushed us to consider using stateful firewalls.  Not to detect traffic related to a CVE, but instead to block everything that wasn't valid application traffic.

From a black-box perspective, our system eventually became immune to all know attacks, including fuzzing.  What it took to finally get us there was a formal, provable specification of ONLY our instrumentation application protocol.  This specification took the form of a lightly modified version of the firewall rule syntax: Our specification was executable!  We used it not just to initialize the firewall, but also to generate the application interface code.  A completely separate version of the specification was used for testing and validation.

Best of all, this made the instrument interface-agnostic and also agnostic to higher-level protocols: We no longer cared where the application traffic was coming from, wired or wireless LAN, even including everything from serial interfaces to cellular gateways (including SMS!).

Bottom line:  1) Use simple firewalls to block all-but-application traffic from the platform.  2) Use stateful application protocol firewall(s) to permit only valid application traffic.

Unfortunately, while this works well for "simple" M2M instrumentation interfaces, it is extraordinarily difficult to scale to more complex and versatile environments, such as a web browser on a PC (or even a Raspberry Pi).

However, it SHOULD scale well to the IoT world.  But it MUST do so in a way that consumers will accept, which means keeping security holes small in both number and duration, especially for conveniences like DHCP and semi-automated WiFi configuration.

To do this, the common internet protocols relevant to IoT must be recast in minimal forms that will support the required IoT functionality and nothing more, and sets of stateful firewall rules must be generated for these protocols.  Then every IoT device must include internal stateful firewalls to execute them.

To do so with any hope of both system-level and application-level security, the IoT application itself  must run in a VM. Which means only processors capable of VM support will be useful for "Secure IoT".  At present this rules out the tremendously popular ARM Mx family of embedded processors, but there is hope that upcoming members of this family will inherit the VM capabilities of their larger brothers.