Adventures in Paradise

The rain drives the tourists off the sidewalks, diminishes the Pacific to a neighbourly size, and melts all my plans like ice cream.

I open the paper and read a wandering, questing letter about the ‘beautiful, innocent people of Vanuatu‘, and ache a little because it’s so nearly true.

In the wall-high mirror, a woman spins her Mickey Mouse umbrella, angles it into the wind, and passes the doorway humming. Her vibrant purple and white island dress is garlanded with ribbons and bows.

An obese Hyundai motor coach lumbers to a halt beside the cafe. Emblazoned in heavy capitals along its side: ADVENTURES IN PARADISE. There is no one on board.

I wrote those paragraphs back in 2003. I’d just arrived in Vanuatu, and was trying to express my first inklings of the nature of the people and the place.

The beauty of Vanuatu and its people has worked itself into the very fibre of my being. The ability to remain gracious and smiling through the most arduous circumstances, to snap out a bawdy joke without missing a beat, to remain impassive in the face of gross affront – these aspects of the national character have impressed, confounded and ultimately seduced me.

But this is no one’s Paradise. Nor will it ever be.

Read more “Adventures in Paradise”

Universal Access

On Wednesday of this week, Minister Edward Nipake Natapei and Australian High Commissioner John Pilbeam jointly announced the creation of a telecommunications Universal Access Fund. Designed to ensure that communications services reach all parts of Vanuatu, the fund was rolled out with an initial contribution from AusAID of 215 million vatu.

The idea is to allow market forces to work in the vast majority of the country, providing mobile telephone services on a for-profit basis. Digicel’s license terms state that it must make its service available to 85% of the population.

Mobile telephone service costs are tiny compared to traditional land lines. Infrastructure is minimal, and it’s not as susceptible to damage by the elements. Digicel is confident that it can profitably provide services over such a wide area. They’re so confident that they’ve ponied up a significant chunk of cash as a performance bond.

In time we’ll see TVL and smaller, ‘boutique’ operators entering these once marginal markets as well. But there will always be areas in Vanuatu that simply can’t be serviced profitably. This is where government enters the scene. They’ve designated a basket of money that will ensure that everyone from Aneityum to the Torres islands has access to mobile phone services.

Read more “Universal Access”

Kastom & The Law: Worlds Apart

It’s hard to decide whether our comprehensive understanding of the causes of crime should be cause for joy or despair. If we see so clearly what needs doing, why don’t we do it?

(Originally published in the Vanuatu Daily Post‘s Weekender Section.)

Last week’s summit on crime at the University of the South Pacific produced many useful recommendations. Perhaps too many.

The recommendations emerging from the 3 day workshop covered an immense scope: Law enforcement, the judicial and penal systems, the role of chiefs, social justice, ethics and civics education as well as employment were all identified as areas where conditions must improve in order to alleviate crime.

It’s hard to decide whether our comprehensive understanding of the problem should be cause for joy or despair. If we see so clearly what needs doing, why don’t we do it?

Allow me to offer an unwelcome answer: We don’t do anything because we as a society don’t want to.
Read more “Kastom & The Law: Worlds Apart”

Trust Works All Ways

Over the weekend, I’ve been thinking about last week’s disclosure concerning Debian’s OpenSSL package, which in effect stated that all keys and certificates generated by this compromised code have been trivially crackable since late 2006.

There’s a pretty good subjective analysis of the nature of the error on Ben Laurie’s blog (thanks, Rich), and of course the Debian crew itself has done a fairly good job of writing up the issue.

The scope of this vulnerability is pretty wide, and the ease with which a weak key can be compromised is significant. Ubuntu packaged up a weak key detector script containing an 8MB data block which, I’m told, included every single possible key value that the Debian OpenSSL package could conceivably create.

The question that kept cropping up for me is: This one-line code change apparently went unnoticed for well over a year. Why is it that crackers and script kiddies never found it and/or exploited it? Numerous exploits on Microsoft Windows would have required far more scrutiny and creativity than this one. Given the rewards involved for 0-day exploits, especially in creating platforms for cross-site scripting attacks, why is it nobody bothered to exploit this?

My hypothesis – sorry, my speculation is this: People at every stage of the production process and everywhere else in the system trusted that the others were doing their job competently. This includes crackers and others with a vested interest in compromising the code. I should exclude from this list those who might have a reasonable motivation to exploit the vulnerability with stealth and to leave no traces. If, however, even they didn’t notice the danger presented by this tiny but fundamental change in the code base, well my point becomes stronger.

The change itself was small, but not really obscure.  It was located, after all, in the function that feeds random data into the encryption process. As Ben Laurie states in his blog, if any of the OpenSSL members had actually looked at the final patch, they would almost certainly have noticed immediately that it was non-optimal.

In all this time, apparently, nobody using Debian’s OpenSSL package has actually (or adequately) tested to see whether the Debian flavour of OpenSSL was as strong as it was supposed to be.  That level of trust is nothing short of astounding. If in fact malware authors were guilty of investing the same trust in the software, then I’d venture to state that there’s a fundamental lesson to be learned here about human nature, and learning that lesson benefits the attacker far more than the defender:

Probe the most trusted processes first, because if you find vulnerabilities, they will yield the greatest results for the least effort.

P.S. Offhand, there’s one circumstance that I think could undermine the credibility of this speculation, and that’s if there’s any link between this report of an attack that compromised not less than 10,000 servers and the recent discovery of the Debian OpenSSL vulnerability.

You Get What You Pay For

(Originally published in the Vanuatu Daily Post‘s Weekender Section.)

Since the Australian Federal Police brought Project Wickenby to Vanuatu with the arrest of local resident Robert Agius and raids at PKF House and elsewhere, people here have been outraged over what they characterise as Australian arrogance. Australia, they charge, feels it’s bought the right to act as it pleases here. By making the government of Vanuatu dependant on their money and advisors, many argue, Australia has subverted Vanuatu sovereignty and now operates as it pleases here.

Mr. Agius stands accused of funneling about $100 million into Vanuatu as phony consulting fees. Prosecutors claim these fees – minus a commission for Mr. Agius – were then sent back to Australia as loans. The loans’ tax-free status allowed participants in the alleged scheme to avoid paying as much as $13 million in taxes.

News reports indicate that Mr. Agius is accused of having earned about $1.4 million from his involvement in this scheme.

The Agius affair is treated as a business story by Australian news sources. The contrast with how it’s reported in Vanuatu could not be starker. Mr. Agius’ guilt or innocence is secondary in the local narrative. This is, above all, a story about Vanuatu’s sovereignty, or lack thereof.

Read more “You Get What You Pay For”

Kastom in the Virtual Nasara

In Vanuatu, Kastom takes a lifetime to learn. More complex than any set of laws, it’s a tightly woven fabric of behaviour that is in a constant state of redefinition. Defined by respect and mutual support, it is measured and arbitrated by our chiefs and enforced by the community as a whole. It is at once amorphous and innately understood.

Although it manifests itself differently from one island to another, the importance of one’s name is integral to finding one’s place in local kastom. Indeed, the highest honour an expat can earn in Vanuatu is to be given a name. A naming ceremony implies the attainment of (usually honourary) chiefly rank. One’s name, in short, is the ultimate expression of one’s place, standing and role in the community. It conveys the very essence of its bearer.

Practices vary from island to island, but choosing – and using – a person’s name is rife with overtones about one’s relation to others. Expats are often confused, and sometimes amused, by most ni-Vanuatu’s unwillingness to address others by name. People are instead referred to in terms of their familial relationship to the speaker. Where relationships are unknown or ambiguous – between strangers, for example – a local default usually exists. It’s common to be addressed as ‘tawi’ in Tanna, though strictly speaking that would make you the person’s brother or sister in law. In a delightful example of linguistic drift, young women in North Malekula are almost universally addressed as ‘uncle’.

So why, when names possess such a strong tabu here in Vanuatu, do we put no stock at all in how Vanuatu’s name is used on the Internet?
Read more “Kastom in the Virtual Nasara”

Steaming Piles

Sometimes you have to destroy the document in order to save it….

I give up. I can’t support OpenOffice Write any more, and it’s nobody’s fault but their own. For anything more than simple tasks, the application is terrible. Their only saving grace is that Microsoft Office has its own brand of polished turd, named Word. Collectively, they are racing to the bottom of a decade-long decline in useability.

No, that’s too generous. The thing is, they’re at the bottom. They are useless for any but the most trivial tasks, and the most trivial tasks are better accomplished elsewhere, anyway.

Yes, I’m ranting. Let’s put this into a proper context:

I hate word processors. For any but the simplest tasks, their interfaces are utterly ridiculous. I haven’t liked a word processing interface since WordPerfect circa version 5, and if I had my own way, I’d author all my documents in either emacs or vi, depending on the circumstances.

Why do word processors suck so badly? Mostly, it’s because of the WYSIWYG approach. What You See Is What You Get, besides being one of the most ghastly marketing acronyms to see the light of day in the digital era, is ultimately a lie. It was a lie back in the early 1990s when it first hit the mainstream, and it remains a lie today. The fact of the matter is that trying to do structuring, page layout and content creation all at the same time is a mug’s game. Even on a medium as well understood as paper, it’s just too hard to control all the variables and still have a comprehensible interface.

But the real sin that word processors are guilty of is not that they’re trying to do WYSIWYG – okay it is that they’re trying to do WYSIWYG, but the way they go about it makes it even worse. Rather than insisting that the user enter data, structure it and then lay it out, they cram everything into the same step, short-circuiting each of those tasks, and in some cases rendering them next to impossible to achieve.

Learning how to write, then structure, then format a document (or even just doing each through its own interface) is easier to accomplish than the all-in approach we use today. For whatever reason, though, we users are deemed incapable of creating a document without knowing what it’s going to look like right now, and for our sins, that’s what we’ve become. And so we are stuck with word processors that are terrible at structuring and page layout as well as being second-rate text authoring interfaces. They do nothing well, and many things poorly, in no small part because of the inherent complexity of trying to do three things at once.

It doesn’t help that their technical implementation is poor. The Word document format is little better than a binary dump of memory at a particular moment in time. For our sins, OpenOffice is forced to work with that as well, in spite of having the much more parse-worthy ODF at its disposal these days.

There’s no changing any of this, of course. The horse is miles away, and anyway the barn burned down in the previous millennium. The document format proxy war currently underway at the ISO is all the evidence I need to know that I’ll be dealing with stupid stupid stupid formatting issues for years to come. I will continue to be unable to properly structure a document past about the 80th percentile, which is worse than not at all. I will continue to deal with visual formatting as my only means to infer context and structure, leaving me with very little capacity to do anything useful with the bloody things except to print them out and leave them on someone’s desk.

Maybe I’ll just stop using them at all. Maybe I’ll just start doing everything on the web and never print again.

I’m half serious about this, actually. At least on the Web, the idea that content and presentation are separate things isn’t heresy. At least on the Web, I can archive, search, contextualise, comment, plan, structure and collaborate without having to wade through steaming piles of cruft all the time.

At least on the Web, I can choose which steaming piles I step into.

I’m going to start recommending people stop using Word as an authoring medium. There are far better, simpler tools for every task, and the word processor has been appropriate for exactly none of them for too long now. Sometimes you have to destroy the document in order to save it.

Only the Angels Cry

Shortly after the news of his son’s death reached me, I encountered Nathan in the space outside his office. In the Vanuatu fashion, I offered my condolences quietly, with few words. Nathan just stood there in front of me, rudderless, smiling as people do when there’s nothing to be said, nothing more to be done. His own life, his future, was gone.

Dead of a boiler. Dead of nothing at all.

Nathan’s little boy died of nothing. The seven year-old got a boiler in his nose. It was painful, but nothing a course of antibiotics couldn’t fix. Nathan dutifully brought his boy to the island hospital, and requested treatment. As usual, there was no doctor present, but a nurse gave him some medicine. The pills were past their expiry date, but they were better than nothing.

The inflammation subsided, and the boy was able the sleep again for a while. The infection, however, didn’t disappear. Once the under-strength antibiotics had run their course, it came back with a vengeance.

To look at the boy, there wasn’t much wrong. A little swelling around one eye and nostril, but otherwise nothing. What you couldn’t see was the constant, excruciating pain as the infection moved into his sinuses and began to press against his brain.
Read more “Only the Angels Cry”

Clearing the Ground

The Vanuatu National Training Council (VNTC) recently presented their vision of an industry-driven training regime here in Vanuatu. The approach is based on what they call Competency Based Training. In simple terms, this approach is aimed to help people learn relevant and useful skills, and importantly, to be able to earn formal recognition for skills they already have. By measuring these skills using well-understood benchmarks, people would be assured that their skills are recognised by employers throughout the Pacific and even beyond.

Read more “Clearing the Ground”