9 ms·

Zed Shaw - The ACL is Dead - CUSEC 2008

123 points by edwardog 18y ago

Recorded almost a year ago (before the bank busts, and shortly after Zed’s first famous rant), this presentation was given to about 400 Canadian undergraduate software engineers and computer scientists. Zed talks about management and his ACL-killer at a bank job accompanied by Factor-powered slideware. Also: steaks, strippers, and statistics. N.B. This video might damage your vision of Zed swearing all the time and may make it seem like the last year of ranting was a terrible joke gone wrong. Oops. P.S. - Check out this year’s lineup (Ingalls, Stallman, Bryant, Culver, Hwang, and Bowkett are just the keynotes). This is one of Canada's best kept secrets, and tickets are super cheap.

bprater 18y ago
Wow, the guy doesn't have horns! He's actually really entertaining to listen to. I like his real-world examples of problems. Steak will never be the same.
davi 18y ago
Notes from lunchtime viewing of first 40 min ------------------------------------ ~9:29: "law is actually kind of a turing complete language" Law is fuzzy; ACLs are fuzzy. ACLs can't handle real law because they're not Turing complete. ~11:20: had a business manager learn Ruby, had him implement poorly specified/tough features --> result: he modified/eliminated requirement ~12:20: a bunch of if statements are easier & better than an ACL ~13:50: in one case, 1000 users and 1000 containers would have required 270,000 ACL entries to implement one compliance rules; and 5 minute polling updates, because rule was time-based; --> couldn't audit, handle real-time changes; would've required 12 beefy boxes to execute. 14:40: Instead, re-write all rules in 400 lines of Ruby; analysts could read the code and say if implementation was right. 15:45: So a language wins, right? No -- "this is where the Suck begins" -- where management comes and crushes your soul. Bad product was substrate for document management system. 17:50: How do they sell this stuff? Connections, subterfuge? No.... "Steak and strippers, baby." 19:00: "This is one reason I want women to be in charge." 20:00: "What happens when they give you an MBA is they give you a lobotomy... and you walk out going 'Synergy! Synergy! Synergy!'" 21:00: MBAs are trained in manufacturing -- programming is not manufacturing -- you're going to work in an environment where they think you're worker bees on an assembly line. 22:00: So what to do about it? 1) Managers see people sitting there, they think nothing is going on. If management says "I demand all of your creativity but trust none of your judgement," you have to gather evidence that makes you more credible. You have to be objective. Try out whatever crappy technology that they're proposing. 2) Develop alternatives: if their crappy technology is good enough, stop; but if not, try out alternatives before suggesting. 3) Statistics; develop some pretty graphs. E.g., Zed's team built a demo server, showing slow performance. Without those, he would've had no evidence to contradict the sysadmin who was saying his tweaks had helped. Be prepared for intensely technical arguments, too. 4) Admit technical deficiencies. ~29:30: If none of this works, and they won't take it, build it anyway and then sell it to them or their competitors. The client can be your first customer. Good way to start a company. ~30:00: our doc management system is very simple, 4400 lines of Ruby plus some Samba modifications, and better than anything else out there. Drools -- JBOSS rules engine -- "blows ass" -- just use Ruby instead. ~31:30: Figure out Roles first, with a Role Resolver -- draws on LDAP etc. -- 30 lines of Ruby -- now, ~200 lines of Ruby, covers all bizarre corner cases, easy to add new rules, easy to fix existing rules. ~33:30: And they still wanted the crappy older thing. At this point, it's all the social problem. What mattered was the old product had the same name. "Document Store 2000" vs. "Document Store New Gen" -- completely different, but easier to get through manager's manager's procurement process -- "that's the stupidity you deal with in the real world". 35:15: How do we win? We kept hammering. They sent out their best guy. I had him implement the toughest rule, the one requiring 200,000 ACL entries. Then had him explain to his managers why it wouldn't work. Had nothing to do with tech. 36:15: This stuff will kill you. How do you keep your soul through all of this? [Poll audience for years of education] -- "It don't matter" -- you're a factory worker. 37:30: "Business leaders don't really like you, because they need you, and they don't understand anything you do. ... And the sales people know this; they know if they go to your boss, and give them steak and strippers...." ~38:40: Fight your hardest not to be a corporate coder: your life as a geek or a coder should be all about exploring some new domain that no one else gets -- you can only go to conferences and talk to other geeks about what you do. A corporate coder works only on the stuff he's supposed to on one language, and never touches code otherwise. You should go home and do something fun with technology. 40:00: how to avoid not getting burnt out by day job? I.e., how to avoid losing your soul? [40:30 stopped watching, back to work.] ------------------------------------
- twism 18y ago
  Immediately after 40:30 is actually the best part of this talk.
  - Prrometheus 18y ago
    I thought the opposite. The real life example of implementing his project was a lot more interesting than yet another exhortation to "be true to yourself".
- michaelneale 18y ago
  on "steak and strippers...." - well I think there is a fundamental misunderstanding - ALL input products (not just software based) is sold this way to large corporations. Everyone has an agenda. Also - its not just big enterprisey things - rails is so common in the enterprise these days due to the "steak and strippers...." work done by companies like thoughtworks. There is always wheeling and dealing, even with grassroots things - things are never as white and as pure as they seem (well almost all things). I don't see this ever changing, unless somehow all these types of corporations simultaneously cease to exist, and something else more merit based takes their place.
  - nihilocrat 18y ago
    There was a story on HN several months ago about a guy on vacation in Istanbul having someone sell him a rug even though he never had any intention of getting one. It outlined a whole lot of non-bullying sales tactics that had nothing to do with the actual product, it was more about putting a person in an environment and state of mind where they felt like getting the product, even if they never really wanted it.
    - michaelneale 18y ago
      Exactly - salesmenship? (is that a word?). So is zed proposing a world where there are no sales people? I guess some people may point to things that "sell themselves" like apples consumer products where people camp out to get them. Sure - but how did apple really get strong enough to survive this long? at least in this country it was steak and stripper sales to the education department to get them in all schools.
sspencer 18y ago
Zed is probably the only blog author I would really like to meet in real life. And this video seems pretty close to what I imagined he'd be like.
- ambition 18y ago
  Come to CUSEC 2009. He'll be there.
  - deleted 18y ago
    [deleted]
nirmal 18y ago
I wish I could see his slides.
- silentbicycle 18y ago
  It's in Factor, right? Is the source available?
  - bk 18y ago
    http://www.zedshaw.com/conferences/cusec2008.factor http://www.zedshaw.com/conferences/cusec2008.factor
    - silentbicycle 18y ago
      Lovely, thank you.
    - tlrobinson 18y ago
      I can't seem to figure out how to run this... I downloaded the OS X distribution, opened it, selected "Run..." from the File menu, and selected the cusec2008.factor file. Now what?
      - tlrobinson 18y ago
        Why was this downvoted? I'm asking a legitimate question.
        glymor 18y ago
        Probably because it's explained on the video page: http://vimeo.com/2723800 http://vimeo.com/2723800 If you are still having trouble try: USE: cusec2008 start-presentation
      - krakensden 18y ago
        Make a 'cusec2008' directory in the distribution's `work' directory, and put the .factor file there. Open the factor runtime, type USE: cusec2008 start-presentation and then hit enter. No, not the most user friendly of processes. But I suppose it's the price you pay for being the indiest of indie.
stcredzero 18y ago
I love that he's saying "The ACL is Dead." This should be said loudly and often. Maybe it'll get through the heads of management out there. Heck, it needs to get through the heads of a lot of programmers. Modern security and access controls need functionality like capabilities.
- davi 18y ago
  Any links? As only a sometime-programmer, the "ACL is Dead" idea is new to me. I could use some good examples.
  - Hoff 18y ago
    Zed Shaw discusses this in several parts within the presentation; it's somewhat of a recurring theme. ACLs as they're implemented on most operating systems are wicked limited; tracking attributes and access to anything beyond simple boolean HAVE_ID or !HAVE_ID or HAVE_THIS+HAVE_THAT logic gets really ugly with an ACL. And the classic ACLs are not at all dynamic, as is pointed out in the presentation. You can't easily tie the access control processing directly into the LDAP directory for employment status or into the system time for time-based rules, for instance. Having access to conditional statements and such to manage access control is infinitely more flexible. This is the "Turing Complete" part of the presentation. This processing all reminded me of what you can do with D inside the DTrace environment, too. But I digress. Watch the presentation. It's worth your time.
    - davi 18y ago
      Thanks -- I did watch the presentation (http://news.ycombinator.com/item?id=420974 http://news.ycombinator.com/item?id=420974) and I get how ACLs could be heavyweight and inflexible -- what I'm looking for are some concrete examples of how else people do it. For example, does Ruby on Rails offer some framework for dealing with this? Or is it a 'just do it' kind of thing? Maybe it's not as complicated as I'm imagining it could be, and that's the point. But some example code would be good to look at. I'll look into this further but thought I'd solicit here first.
allertonm 18y ago
Lots of stuff here that resonates with this some-time CMS architect and soulless corporate wage slave, but I missed the part where Zed was able to provide an easy-to-use UI to allow non-programming sysadmins to change the security rules. That must have been so simple he didn't need to mention it, right... right?
- gnaritas 18y ago
  No, but he is saying that complex things require an actual language, not a point and click UI idiots can use, so changes to rules would require a programmer. Seriously, the idea that a complex system can be built by non programmers is somewhat of a pipe dream, it always ends up being more complex than some simple code a programmer can understand.
  - allertonm 18y ago
    I agree wholeheartedly with your last statement, but my point was that Zed got through the whole hour without once mentioning that this was a trade-off that was being made - and it is a pretty important one. (Also, non-programmers != idiots)
    - michaelneale 18y ago
      yeah it sounded like a compromise - obviously an acceptable one, but it was brushed over.
    - gnaritas 18y ago
      It was not a trade off being made. The point and click UI could no longer meet the requirements. That's what he was getting at saying the legalese was turing complete. The requirements the law now mandated required an actual language to to implement because the old system with ACL's can't do the job anymore. That the new system doesn't have a point and click UI isn't a trade off, it's just a consequence. He wasn't trading a complex system for a simpler system, he was replacing a complex system that could no longer work with a simpler one that could. And while not being a programmer doesn't mean you're an idiot, not being able to learn some simple scripting to modify rules does make you an idiot. If your job requires you to modify the rules, and you can't learn to do it, you're dumb. All intelligent people are capable of learning some simple scripting.
markessien 18y ago
Zed is going to become important. It's easy to write, but it's not easy to look good on video, as well as have good video timing. He's not perfect, but he's good. If he sticks to his rant-personality, he will sooner or later become on of the stars of the internet.
- old-gregg 18y ago
  Personally I don't see who can compete even now. Zed's blog is the only blog RSS feed I have in my reader. Nobody else has earned the privilege so far. Everything else in my reader is corporate stuff like HN or arstechnica.
thomasfl 18y ago
fucking awesome
shaunxcode 18y ago
Zed Shaw: Joe Hill of programming. Though rather than organizing workers into unions/factions of the IWW he is advocating people reserve their "real" programming/creativity for themselves unless they stand to make a profit (which they would if labor conditions were equitable). I can totally get behind that.
thenduks 18y ago
This whole "must follow speaker with camera" thing has _got_ to stop. Just stick the camera on the slides and leave it there. _At least_ get both in the frame. This is pushing unwatchable with him pointing to the slides all the time, the audience laughing at the slides, he's referring to code on the slides... Kill me :/
- michaelneale 18y ago
  Hey that sounds like a neat camera product idea: how common is it that you want to record 2 visuals at once? Pretty common - so a little camera with 2 separate point-able lenses would be nice - or something like that.

123 points by edwardog 18y ago

bprater 18y ago

Wow, the guy doesn't have horns! He's actually really entertaining to listen to. I like his real-world examples of problems. Steak will never be the same.

davi 18y ago

Notes from lunchtime viewing of first 40 min ------------------------------------ ~9:29: "law is actually kind of a turing complete language" Law is fuzzy; ACLs are fuzzy. ACLs can't handle real law because they're not Turing complete. ~11:20: had a business manager learn Ruby, had him implement poorly specified/tough features --> result: he modified/eliminated requirement ~12:20: a bunch of if statements are easier & better than an ACL ~13:50: in one case, 1000 users and 1000 containers would have required 270,000 ACL entries to implement one compliance rules; and 5 minute polling updates, because rule was time-based; --> couldn't audit, handle real-time changes; would've required 12 beefy boxes to execute. 14:40: Instead, re-write all rules in 400 lines of Ruby; analysts could read the code and say if implementation was right. 15:45: So a language wins, right? No -- "this is where the Suck begins" -- where management comes and crushes your soul. Bad product was substrate for document management system. 17:50: How do they sell this stuff? Connections, subterfuge? No.... "Steak and strippers, baby." 19:00: "This is one reason I want women to be in charge." 20:00: "What happens when they give you an MBA is they give you a lobotomy... and you walk out going 'Synergy! Synergy! Synergy!'" 21:00: MBAs are trained in manufacturing -- programming is not manufacturing -- you're going to work in an environment where they think you're worker bees on an assembly line. 22:00: So what to do about it? 1) Managers see people sitting there, they think nothing is going on. If management says "I demand all of your creativity but trust none of your judgement," you have to gather evidence that makes you more credible. You have to be objective. Try out whatever crappy technology that they're proposing. 2) Develop alternatives: if their crappy technology is good enough, stop; but if not, try out alternatives before suggesting. 3) Statistics; develop some pretty graphs. E.g., Zed's team built a demo server, showing slow performance. Without those, he would've had no evidence to contradict the sysadmin who was saying his tweaks had helped. Be prepared for intensely technical arguments, too. 4) Admit technical deficiencies. ~29:30: If none of this works, and they won't take it, build it anyway and then sell it to them or their competitors. The client can be your first customer. Good way to start a company. ~30:00: our doc management system is very simple, 4400 lines of Ruby plus some Samba modifications, and better than anything else out there. Drools -- JBOSS rules engine -- "blows ass" -- just use Ruby instead. ~31:30: Figure out Roles first, with a Role Resolver -- draws on LDAP etc. -- 30 lines of Ruby -- now, ~200 lines of Ruby, covers all bizarre corner cases, easy to add new rules, easy to fix existing rules. ~33:30: And they still wanted the crappy older thing. At this point, it's all the social problem. What mattered was the old product had the same name. "Document Store 2000" vs. "Document Store New Gen" -- completely different, but easier to get through manager's manager's procurement process -- "that's the stupidity you deal with in the real world". 35:15: How do we win? We kept hammering. They sent out their best guy. I had him implement the toughest rule, the one requiring 200,000 ACL entries. Then had him explain to his managers why it wouldn't work. Had nothing to do with tech. 36:15: This stuff will kill you. How do you keep your soul through all of this? [Poll audience for years of education] -- "It don't matter" -- you're a factory worker. 37:30: "Business leaders don't really like you, because they need you, and they don't understand anything you do. ... And the sales people know this; they know if they go to your boss, and give them steak and strippers...." ~38:40: Fight your hardest not to be a corporate coder: your life as a geek or a coder should be all about exploring some new domain that no one else gets -- you can only go to conferences and talk to other geeks about what you do. A corporate coder works only on the stuff he's supposed to on one language, and never touches code otherwise. You should go home and do something fun with technology. 40:00: how to avoid not getting burnt out by day job? I.e., how to avoid losing your soul? [40:30 stopped watching, back to work.] ------------------------------------

twism 18y ago
Immediately after 40:30 is actually the best part of this talk.
- Prrometheus 18y ago
  I thought the opposite. The real life example of implementing his project was a lot more interesting than yet another exhortation to "be true to yourself".
michaelneale 18y ago
on "steak and strippers...." - well I think there is a fundamental misunderstanding - ALL input products (not just software based) is sold this way to large corporations. Everyone has an agenda. Also - its not just big enterprisey things - rails is so common in the enterprise these days due to the "steak and strippers...." work done by companies like thoughtworks. There is always wheeling and dealing, even with grassroots things - things are never as white and as pure as they seem (well almost all things). I don't see this ever changing, unless somehow all these types of corporations simultaneously cease to exist, and something else more merit based takes their place.
- nihilocrat 18y ago
  There was a story on HN several months ago about a guy on vacation in Istanbul having someone sell him a rug even though he never had any intention of getting one. It outlined a whole lot of non-bullying sales tactics that had nothing to do with the actual product, it was more about putting a person in an environment and state of mind where they felt like getting the product, even if they never really wanted it.
  - michaelneale 18y ago
    Exactly - salesmenship? (is that a word?). So is zed proposing a world where there are no sales people? I guess some people may point to things that "sell themselves" like apples consumer products where people camp out to get them. Sure - but how did apple really get strong enough to survive this long? at least in this country it was steak and stripper sales to the education department to get them in all schools.

sspencer 18y ago

Zed is probably the only blog author I would really like to meet in real life. And this video seems pretty close to what I imagined he'd be like.

ambition 18y ago
Come to CUSEC 2009. He'll be there.
- deleted 18y ago
  [deleted]

nirmal 18y ago

I wish I could see his slides.

silentbicycle 18y ago
It's in Factor, right? Is the source available?
- bk 18y ago
  http://www.zedshaw.com/conferences/cusec2008.factor http://www.zedshaw.com/conferences/cusec2008.factor
  - silentbicycle 18y ago
    Lovely, thank you.
  - tlrobinson 18y ago
    I can't seem to figure out how to run this... I downloaded the OS X distribution, opened it, selected "Run..." from the File menu, and selected the cusec2008.factor file. Now what?
    - tlrobinson 18y ago
      Why was this downvoted? I'm asking a legitimate question.
      - glymor 18y ago
        Probably because it's explained on the video page: http://vimeo.com/2723800 http://vimeo.com/2723800 If you are still having trouble try: USE: cusec2008 start-presentation
    - krakensden 18y ago
      Make a 'cusec2008' directory in the distribution's `work' directory, and put the .factor file there. Open the factor runtime, type USE: cusec2008 start-presentation and then hit enter. No, not the most user friendly of processes. But I suppose it's the price you pay for being the indiest of indie.

stcredzero 18y ago

I love that he's saying "The ACL is Dead." This should be said loudly and often. Maybe it'll get through the heads of management out there. Heck, it needs to get through the heads of a lot of programmers. Modern security and access controls need functionality like capabilities.

davi 18y ago
Any links? As only a sometime-programmer, the "ACL is Dead" idea is new to me. I could use some good examples.
- Hoff 18y ago
  Zed Shaw discusses this in several parts within the presentation; it's somewhat of a recurring theme. ACLs as they're implemented on most operating systems are wicked limited; tracking attributes and access to anything beyond simple boolean HAVE_ID or !HAVE_ID or HAVE_THIS+HAVE_THAT logic gets really ugly with an ACL. And the classic ACLs are not at all dynamic, as is pointed out in the presentation. You can't easily tie the access control processing directly into the LDAP directory for employment status or into the system time for time-based rules, for instance. Having access to conditional statements and such to manage access control is infinitely more flexible. This is the "Turing Complete" part of the presentation. This processing all reminded me of what you can do with D inside the DTrace environment, too. But I digress. Watch the presentation. It's worth your time.
  - davi 18y ago
    Thanks -- I did watch the presentation (http://news.ycombinator.com/item?id=420974 http://news.ycombinator.com/item?id=420974) and I get how ACLs could be heavyweight and inflexible -- what I'm looking for are some concrete examples of how else people do it. For example, does Ruby on Rails offer some framework for dealing with this? Or is it a 'just do it' kind of thing? Maybe it's not as complicated as I'm imagining it could be, and that's the point. But some example code would be good to look at. I'll look into this further but thought I'd solicit here first.

allertonm 18y ago

Lots of stuff here that resonates with this some-time CMS architect and soulless corporate wage slave, but I missed the part where Zed was able to provide an easy-to-use UI to allow non-programming sysadmins to change the security rules. That must have been so simple he didn't need to mention it, right... right?

gnaritas 18y ago
No, but he is saying that complex things require an actual language, not a point and click UI idiots can use, so changes to rules would require a programmer. Seriously, the idea that a complex system can be built by non programmers is somewhat of a pipe dream, it always ends up being more complex than some simple code a programmer can understand.
- allertonm 18y ago
  I agree wholeheartedly with your last statement, but my point was that Zed got through the whole hour without once mentioning that this was a trade-off that was being made - and it is a pretty important one. (Also, non-programmers != idiots)
  - michaelneale 18y ago
    yeah it sounded like a compromise - obviously an acceptable one, but it was brushed over.
  - gnaritas 18y ago
    It was not a trade off being made. The point and click UI could no longer meet the requirements. That's what he was getting at saying the legalese was turing complete. The requirements the law now mandated required an actual language to to implement because the old system with ACL's can't do the job anymore. That the new system doesn't have a point and click UI isn't a trade off, it's just a consequence. He wasn't trading a complex system for a simpler system, he was replacing a complex system that could no longer work with a simpler one that could. And while not being a programmer doesn't mean you're an idiot, not being able to learn some simple scripting to modify rules does make you an idiot. If your job requires you to modify the rules, and you can't learn to do it, you're dumb. All intelligent people are capable of learning some simple scripting.

markessien 18y ago

Zed is going to become important. It's easy to write, but it's not easy to look good on video, as well as have good video timing. He's not perfect, but he's good. If he sticks to his rant-personality, he will sooner or later become on of the stars of the internet.

old-gregg 18y ago
Personally I don't see who can compete even now. Zed's blog is the only blog RSS feed I have in my reader. Nobody else has earned the privilege so far. Everything else in my reader is corporate stuff like HN or arstechnica.

thomasfl 18y ago

fucking awesome

shaunxcode 18y ago

Zed Shaw: Joe Hill of programming. Though rather than organizing workers into unions/factions of the IWW he is advocating people reserve their "real" programming/creativity for themselves unless they stand to make a profit (which they would if labor conditions were equitable). I can totally get behind that.

thenduks 18y ago

This whole "must follow speaker with camera" thing has _got_ to stop. Just stick the camera on the slides and leave it there. _At least_ get both in the frame. This is pushing unwatchable with him pointing to the slides all the time, the audience laughing at the slides, he's referring to code on the slides... Kill me :/

michaelneale 18y ago
Hey that sounds like a neat camera product idea: how common is it that you want to record 2 visuals at once? Pretty common - so a little camera with 2 separate point-able lenses would be nice - or something like that.