Fw: [RRE] notes and recommendations

[Kragen Sitaker]

The latest Red Rock Eater "notes and recommendations" contained chunks
on several different topics; I thought the ones on PR and rhetoric were
the most interesting ones, and I enclose them here.

In response to my notes on the slippery language Microsoft has used to
evade responsibility for the security problems that were exploited by
the most recent e-mail virus, RRE readers sent me a slew of additional
quotes from Microsoft personnel, including some that are astounding.

We can begin with another example of defocusing: redefining the issue
by eliding certain elements of critics' arguments:

  "The issue here isn't scripting.  It's the social phenomenon of
  virus writing.  That virus could have been written as an executable
  or on any platform or in a nonscripting language.  Just because this
  virus was written in a scripting language, and we happen to support
  scripting in our operating system, doesn't make it a security issue."
  
  http://news.cnet.com/news/0-1003-200-1823167.html

Read this passage closely.  Leave aside the question -- hard to even
discuss because it is so conveniently vague -- of whether "that virus"
could possibly have been written in another language or even on another
platform and still been the same virus.  The problematic part starts
with "Just because ...".  It's conceivable that someone, somewhere has
argued that the problem is the simple existence of scripting languages.
That person would be a convenient foil, but would hardly represent the
mainstream of critical opinion.  The problem, as everyone knows, is
not scripting languages, but email clients that can execute attachments
that contain scripts that can perform a wide variety of potentially
damaging actions.  Blaming "the social phenomenon of virus writing"
is not reasonable.  A product that can be subverted by a random college
student to cause massive worldwide damage is not secure.  That's what
"secure" means.

Given the scope of the recent disaster, some people were surprised to
find the following text in a Microsoft "knowledge base" page entitled 
"General Information About Using VBScript with Outlook":

  VBScript is designed to be a secure programming environment.  It
  lacks various commands that can be potentially damaging if used in
  a malicious manner.  This added security is critical in enterprise
  solutions.

  http://support.microsoft.com/support/kb/articles/Q167/1/38.ASP
  
(In case the page changes, I copied and pasted above passage on the
evening of 5/8/00.)

Rereading the passage I've quoted, one notices that no claim is made
that VBScript includes no commands that can cause damage -- only that
"various commands" are not included -- and likewise that no claim
is made that VBScript under Outlook is secure -- it only has "added
security".  It sounded good when I read it the first time, though.

Or consider the following passages from a message from Microsoft,
dated 5/8/00 and entitled "Special Edition -- Office News Service --
Virus Alert":

  Last week a new virus began circulating through e-mail that has the
  potential to affect a wide range of e-mail users including those
  users running Microsoft Outlook.  If run, the virus could overwrite
  .jpg, .mp3 and other file types, and attempt to send a copy of
  itself to everyone in the recipient's address book.

The language here attempts to break any mental association between
the virus vulnerability and Outlook.  The virus, we are told, "has the
potential to affect a wide range of e-mail users including those users
running Microsoft Outlook".  A hurried reader would take away the
impression that the problem is not Outlook-specific.  But two seconds'
thought will raise doubts.  First, the virus will only work on a
machine that can execute Visual Basic scripts.  That narrows it down
quickly to a small range of Microsoft platforms.  One might ask, do
other Microsoft mailers execute Visual Basic scripts in attachments?
But that's not what the passage says.  It says only that the virus
"has the potential to affect a wide range of e-mail users".  Someone
who uses a Windows 98 mail client besides Outlook could for whatever
reason save the attached VBS file and then specifically execute it
from the desktop.  This could "affect" the user's machine (damaged
files, modified startup, reset Explorer homepage), but it wouldn't
propagate the virus because the propagation mechanism relies on the
Outlook address book.  This particular claim turns out to be correct, 
but you have to read it carefully.

At least the passages I have quoted so far are just evasive.  Some
of Microsoft's statements have been outright false.  Here is a later
passage in the same text:

  1) Customers can avoid being affected by this and other viruses by
  following standard best practices:
  ++ Never run an executable from someone you don't know.
  ++ Always have a good-quality virus scanner.
  ++ Always keep the virus scanner's signature files up to date.

This is just not true.  The messages that contained this virus were
from people who had you in their address books; they are therefore
likely to be people that you know.  The suggested policy of not
opening attachments (now called "running executables" -- even though
the idea that opening an attachment *is* running an executable will
be counterintuitive for most normal users) from people you don't
know will not prevent this virus from spreading.  Nor will the other
suggested policies prevent the virus: the best widely used virus
scanners (for some weird reason) do not stop this sort of virus
without it being included in a signature file, and the signature files
in this case (as in other cases) were not updated until the virus had
already spread far and wide.  It is little wonder, then, that the same
Microsoft message included the following disclaimer:

  INFORMATION PROVIDED IN THIS DOCUMENT IS PROVIDED 'AS IS' WITHOUT
  WARRANTY OF ANY KIND.  The user assumes the entire risk as to the
  accuracy and the use of this document.

The following astonishing passage is from an online column about
Microsoft's irresponsibility by Hiawatha Bray of the Boston Globe.

  When I raised the issue with Microsoft spokesman Adam Sohn last
  week, he described his idea of how companies could improve the
  security of Outlook.  "They should commence by beating their
  employees", Sohn declared.

  He chuckled to signify that he was kidding -- but only about the
  floggings.  Sohn was dead serious about Microsoft's utter lack
  of responsibility for the Love Bug fiasco.  Instead, he blamed
  the silly computer users who go opening e-mail attachments. 
  "People shouldn't open them", said Sohn.  "That's the problem."

  http://www.digitalmass.com/columns/software/0508.html

A Microsoft spokesman is joking that employees should be beaten
for opening an attachment -- an attachment from a friend no less.
I am not making this up.

Finally, listen to this quote from Microsoft's inescapable Scott Culp:

  In this case the virus author chose to target Outlook probably
  because it gave him better reach.  There isn't a security
  vulnerability in Outlook involved in this at all.

  http://dailynews.yahoo.com/h/nm/20000504/wr/virus_love_11.html

Mr. Culp thinks he is playing a game.  Look everyone!  I've managed
to spin this situation into being something good about Microsoft!
Never mind the lack of logical connection between the two sentences.
This is the company whose products are being used to rebuild the
productive infrastructure of the entire world, including large parts
of the US military.  We are insane to be doing business with them.


What really causes these endless computer security disasters?  We've
talked about economic factors, but now I think we have to talk about
another factor: weenies.  Weenies come in two varieties, tech and
marketing.  Tech weenies think they're smart but aren't mature enough
to do real engineering.  Marketing weenies mechanically apply the
marketing dogmas of product differentiation but aren't capable of
having a real vision for their products.  Multics was designed by
real engineers and the Mac was designed by marketing visionaries,
but Windows was designed by weenies.  The most distinctive feature of
weenies is the worship of features.  Tech weenies want everything to
be cool: that means hypergeneral, hyperprogrammable, hyperextensible,
no matter what hazards might result.  Marketing people obsessively
look at the complete list of features in their competitors products
and command the tech weenies to include all of them, and then to
differentiate the product by adding more.

The tech weenies and marketing weenies typically hate each other, but
they have this in common: neither of them will ever voluntarily remove
a feature from a product, even if it causes billions of dollars in
damage.  Tech weenies are basically designing for themselves, and have
no conception of human beings and their relationships -- and thus no
coherent trust model in their products.  Marketing weenies are frantic
to get products to market, and have the shortest possible time horizon
-- and thus no concern for the world in which their products will soon
enough become ineradicable legacy systems.  Weenies too often win in
high-technology competition because a critical mass of their customers
lacks detailed knowledge of the products.  (Keep in mind that the real
customers of a company like Microsoft -- the ones who sign the checks
-- are generally neither the technical people nor the users.)  Security
catastrophies will not disappear until the weenies are all under adult
supervision.  This will never happen at Microsoft, which is managed by
two-year-olds who hire people just like themselves.  One more reason to
shut it down.


The Daily Howler has begin a month-long examination of the terrifying
pathology of the media in the ongoing presidential campaign.

  http://www.dailyhowler.com/

Strongly recommended.

. . .

A while back I called for the creation of Stats Watch, a nonprofit
organization of statisticians who issue press releases and conduct
publicity stunts when they spot abuses of statistics in the media.
Well, the other day I noticed an AP wire report about an organization
called Statistical Assessment Service <http://www.stats.org/> that
claimed to have determined in a scientific manner that Al Gore's
statistics were bad and George W. Bush's statistics were just fine.
Looking more closely, I found that this organization is a partisan
conservative activist group that uses public relations tactics but
pretends to be scientific and neutral.  I was depressed at this
disingenuous stuff, which illustrates why it's so hard to main any
standards of rationality in a world of public relations.

. . .

When I tell the truth on this list, I sometimes get hate mail.  Not
that much, really, but enough.  When I do get nasty messages, they are
obviously from people who have had a lot of practice.  And I always
go through the same cycle: I send a short, intemperate response; I
delete the message; I breathe several times to get the anger out of my
system; I regret responding at all; an hour passes; I realize just how
sophisticated the rhetoric of the hate message was; and I regret not
having saved it.  This happens over and over.  My last round of notes,
however, got so many responses so quickly that one hate message was
still retrievable an hour later as I worked my way through subsequent
messages.  I enclose it here not to seek sympathy, which I truly do
not deserve, but because I find it interesting.  Note, above all, that
at no point does it make logical sense.  At the risk of interrupting
its trance-like flow, I have interleaved my own commentary.

  There was a time when I gleaned much that I considered worthwhile
  from your articles, but that time has passed.  In my opinion, you
  have put on blinders that restrict your view(s) as much to leftist
  dogmas and propaganda as any of the "conservative paranoia" you
  describe.

The high-toned first sentence melodramatically posits the high ground
from which he issues the abuse to follow.  Then he's right into it.
The illogic begins right away, as the second sentence can't decide
whether it's accusing me of spouting left-wing views or of blinding
myself to them.  It falls strangely into the middle, so that I can't
figure out what I'm being accused of.

  I gather that we should criticize George Bush for never having held
  a "real job", but the same condition in the life of Bill Clinton is
  perfectly acceptable.

This is extremely common.  Conservatives are trying to bring back the
culture of deference in which double standards are a routine way of
life, and to this end they continually manufacture bogus accusations
of double standards against the egalitarians who have long pointed
out double standards as a way of insisting that everyone be treated
equally.  In this case, the accusation is bogus in a straightforward
factual sense; before becoming President, Bill Clinton had at least
two real jobs -- as a law professor and as governor of Arkansas -- and
pointing that out surely doesn't make one a raving liberal.  (Because
of conservative media bias, many people are unaware that the Texas
constitution, unlike that of Arkansas and most other states, assigns
the governor very little power.)  Most likely this guy is fabricating
his double-standard accusation by distoring, in the blurry fashion of
lizard-brain thinking, the conservative accusation that Bill Clinton
never held a job in the private sector before he become President.
Or perhaps he is twisting language by secretly redefining a "real job"
as one in the private sector.  In either case he is twisting language.

Notice, too, the routinized innuendo: "I gather", he says, that he
is to believe a certain thing, even though I never said that thing
or anything like it.  "I gather" is one of many devices in the new
jargon for poking anything one likes into the mind and mouth of
one's opponent.  And the innuendos are about to start coming fast
and furious.

  Regardless of the issues surrounding so-called "father's rights",
  (and given that no father currently has _any_ say in whether his
  child is to be born or aborted, I doubt that there is any such thing
  as "father's rights" in the U.S. law), are you at all concerned
  about the legal and constitutional aspects of the recent "rescue"
  of Elian Gonzalez?  Or of the lives lost in Waco and the "factory"
  in the Sudan?

These questions are really accusations; he already knows the answer
and isn't waiting around.  But because the accusations *have* been
framed as questions, I am left with no way to disprove them.  That's
the nature of an innuendo.

Look, too, at the logic here, or the lack of it.  First of all, it
does not follow logically that a man who cannot compel a woman to
carry his child has no rights as a father.  He claims to "doubt" a
buzz phrase ("father's rights") that, like many phrases of the new
jargon (e.g., "special rights"), has no real definition, just a hazy
set of associations.  To rebut this, one would have to enumerate the
possible definitions.  And note in particular that his rhetoric here
depends on a conflation of two such definitions: rights as a father
as against the rights of a mother (not at issue in the present case
because the mother is not alive) and rights that a father has for being
a living parent (which obviously exist in US law in great abundance).

Having stumbled through all that, I next find myself not-quite-accused
of indifference to "the legal and constitutional aspects of the recent
'rescue' of Elian Gonzalez" -- the scare-quoted "rescue" being my own
word.  This is another technique of the new jargon: create a "message",
call it M, utter a few random "facts" that would seem to support M,
and then immediately start repeating M over and over without mentioning
the facts that support it, as if M were fully established.  The device
works precisely by not laying its cards on the table: one cannot rebut
it without reconstructing the full set of "facts" and patiently taking
them all apart.  As so often, the sophistry takes a few words to say
and hours of labor and logic to refute.  Of course, society does often
come to conclusions whose supporting facts need not be repeated forever
afterward, but it's characteristic of the new jargon to pretend that
a "message" has been established beyond doubt almost instantaneously
after it has been introduced.  If one complains that, for example, the
most common assertion that is used to support the message is actually
false -- in this Tom DeLay's seriously lizard-brained assertion that
"This is a frightening event, that American citizens now can expect
that the executive branch on their own can decide on whether to raid
a home" (AP 4/23/00) -- then you'll get no contrition at all, just
a prefabricated line such as "that doesn't matter; what matters is M"
or else another "fact" that needs to be laboriously checked out.

But at least the business about Elian Gonzalez was connected in some
way to something I said.  The next rhetorical question -- "Or of the
lives lost in Waco and the 'factory' in the Sudan?" -- has no logical
connection at all.  One cannot even begin to interpret this question,
much less answer it, without providing some account of what it is
even doing there.  And clearly it is there because this guy, with
his lizard brain logic, imagines me to be on the Clinton side, so
to speak, and to defend every bad deed and tolerate every lie that
that side has ever told.  (Also notice the weirdness of putting scare
quotes around the word "factory".  I'm not aware of anyone having
denied that the building that Clinton bombed in Sudan was a factory.)
This is the lizard brain at work: it understands only associations.
Every possible bad thing is associated with Clinton, and everyone
who gets themselves associated with Clinton is also transitively
associated with every last one of those bad things.  This is another
purpose of the rhetorical question: the transitive association and
the accusation it implies are not to be rationally investigated;
they are left simply to hang in the air.  It is the work of innuendo:
create a mental association and then stash it on a shelf just beyond
the reach of rational inquiry, in this case by first posing it as a
rhetorical question and then packing and leaving.

  What is the Constitution to you?  Does it matter to you that lacking
  any will or effort on the part of the federal government to enforce
  it, the Constutution is just another piece of paper?  Or that, so
  far, the "oath" to defend and uphold it, at least for the present
  administration, has turned out to be just so much hot air?

This guy has been at the hard stuff.  A primitive kind of mental
electricity is passing through his chain of associations, so that my
reference to "the administration's motives in rescuing a Cuban boy who
was being held by conservatives in Miami" is enough to create a spiral
that leads in a couple of short steps to the conclusion -- another
rhetorical question, another innuendo -- that I have no regard for the
Constitution.  For the lizard brain, a person is either For or Against
a powerful symbol such as the Constitution -- always necessarily an
emotionally primitive extreme with no in-betweens allowed -- and in
this person's lizard brain Clinton is Against the Constitution and so
am I.  It matters for nothing that I have defended the Constitution
against several conservative assaults -- such data cannot even be
processed.  (Other cultivators of the lizard brain have responded to
such things with, "How can you defend that so-and-so?", the innuendo
being that I have thereby chosen to associate myself with him in every
possible way.)

  In your opinion, is there any such thing as "right" or "wrong" in
  any context that will continue beyond the term of a single President?

Now we reach the ground zero of the lizard brain, for which it's
just a few quick steps from a complex issue to the most primitive
dichotomy there is.  To me, the Elian Gonzalez case is the purest
possible example of how primitive the conservative lizard brain has
become.  Here you have your basic hard case: one where several strong
moral imperatives apply equally well and yet contradict one another.
Normal people understand that the world is a complicated place, and
that this sort of conflict is pretty much the norm.  But the lizard
brain believes in absolutes.  And if the absolutes conflict with
one another, the lizard brain is programmed to respond to whichever
arbitrary choice of absolutes the most primitive of media screamers
happens to make.

This is what is so dangerous about the conservative lizard brain: its
judgements are very often absolutely arbitrary.  This arbitrariness
is not an accident.  Conservative society works by breaking down the
rational mind and replacing it with a set of primitive associations
that can be activated selectively by those in power.  People who
might otherwise have been rational, powerful, caring human beings
are reduced to barking dogs who bark at whoever their master tells
them to, all the while shrieking both inwardly and to the world that
they are upholding everything that is good and pure and moral against
everything that is the absolute opposite.  The point is not that
all conservatives are in this state, or that conservative philosophy
is necessarily expressed in the anti-logic of the lizard brain.  The
point, rather, is that a conservative society of orders and classes
requires ordinary people to internalize a system of arbitrariness
and prejudice that cannot be justified, and that such a society
cannot exist without crushing the rational mind.  That's what's going
on right now.  The modern technology of crushing the rational mind
originated with the associationism of public relations, and it has
lately matured in the hands of the professional language-twisters of
the punditry.  We all have lizard brains, and all of us automatically
respond to the strong emotions and vague associations of the new
jargon.  But some people's rational minds have not yet been fully
extinguished, and those people have a responsibility to speak out.

  I wonder.

He wonders.  Except he doesn't, of course.  He has framed the issues
to his satisifaction in the anti-rational haze of the lizard brain, in
which it suffices to issue innuendos and walk away.

  Meanwhile, please arrange for my name and address to be removed from
  your distribution list.  I do not have time to plow through the kind
  of crap you sent me today.

And walk away he does, gone off to abuse someone else.  It used to be
that I responded to obnoxious people said "take me off your mailing
list" with "take yourself off".  Now, having grown older and wiser, I
have a form letter that I send, explaining at length and with vacuous
good cheer how to take themselves off.  This is a trick I learned from
Amazon.com: it not only saves your soul, but it also makes the flamer
much angrier than an angry response would.


Conservatives have the most highly evolved jargon, but they haven't
cornered the market on nastiness.  I also got this message from
someone who evidently works for the state of North Carolina:

  You know, Mr. Pagre, this 'worm design' email may have positive
  ironic and political undertones, show up the establishment's
  hypocrisy and all other sorts of positive things.

  However, adding one more black mark to rack up to Pagans makes your
  Karma that much more problematic.

  Samhain is a holy time of the year.  Why not pick on the Christians?
  Most of the group you are targeting belong to that group.  You've
  just managed to piss off the witches of the world, and there are a
  lot more of them than you think.

Having no tolerance for anything that resembles a threat, I reported
this message to the sender's site administrator.