Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Attacks/Breaches

6/11/2007
09:48 AM
Connect Directly
Google+
Twitter
RSS
E-Mail
50%
50%

Architect's Many Identities

Dale Olds, creator of Novell's eDirectory, talks open-source ID, tuba photography, and how not to configure your home firewall

After a long day of developing an open-source identity environment, Novell distinguished engineer (yep, that's his title) Dale Olds unwinds by schlepping around his broken tuba and a camera -- photographing the instrument sitting on a mountaintop, Temple Square in Salt Lake City, hanging from a tree, and even parked in a men's restroom.

Figure 1:

Olds, who is one of the original architects of Novell's eDirectory and currently heads up its Bandit project, has had the ramshackle tuba since high school when he found it sitting in his neighbor's trash. He took a photo of the tuba there and decided to keep it and shoot it on location in other places which he has done on and off over the years. He got a new digital SLR camera recently, and now he's back shooting the tuba. "The tuba pictures have gotten a resurgence" now.

He says there's a strange symmetry here with his day job. "There's a correlation [between] a lot of people I work with in the industry and music and photography." Olds says he sees a link between identity and security folks and quirky senses of humor and photography.

But the dangers of identity theft and security are no joking matter to Olds, 46. He says the main problem is users have too many online accounts, and there's no way they can truly secure and manage them. "It's difficult to keep track of usernames and passwords for all those accounts and it's insecure," he says.

What scares him even more are efforts to centralize identity data under one umbrella. "Identity is already everywhere," he says. "We see this with the lessons we learned with NDS: Large corporations could hold and manage all the [identity data] and control ACLs [access control lists] on it. But that meant NDS admins were a political entity and had too much power in the organization. That became a big bottleneck."

Bandit's goal is to provide open source components for authorization, authentication, and auditing, he says, so you have a consistent IT experience.

When he first joined Novell, Olds served a brief stint as manager of the OS/2 Redirector team. But Olds confesses management wasn't for him: "I just really sucked at being a manager," he says. So Olds took up a project to resuscitate a Novell project that implemented X.500 Directory Services for NetWare, which eventually became NetWare Directory Services, and now, eDirectory.

"At the time I thought, 'OK, I'll take it because this project was already flailing for a year, and it has no chance for success, but it would get me working on the network kernel, into the guts of the OS,'" he says.

He notes that directory services really isn't called that anymore -- it's now morphed into identity management.

It was Olds' son JT, now 21, who actually gave the elder Olds his first official lesson in security, however. JT, who had come home from college on a visit, noticed that the family's firewall wasn't configured properly, resulting in one of the home computers being compromised. His dad had left the SSH port visible and the family babysitter's account on one machine had been compromised. "I had a breach in my firewall, and he chewed me out and locked me out of the firewall," the elder Olds recalls. "He said he's a security guy and I'm an identity guy, and that's why my security practices were lax."

JT, a student at the University of Minnesota and currently an intern with Google, was aware of a wave of password attacks targeting weak passwords like that of the Olds' babysitter. "So he reinstalled all the machines and wouldn't give me the password to the firewall," Olds says with a laugh. "So we had a standoff for a month. Finally, I made it clear I still paid for the DSL. So he gave me back the password."

Olds says the key to securing identity is networking human identities like machines. "If we do something like combine all user credentials into a single store and try to protect it, we could end up with a doomsday scenario politically and otherwise, and end up doing real harm. That's the really scary aspect of this."

Personality Bytes

  • Instruments Olds plays: Not the tuba... "Violin, guitar, mandolin, though none of them well anymore."

  • Coding for fun rather than profit: "A few snippets of C# code on Mono to help my daughter solve some number problems for her homework. Also, some code to automatically find duplicate files (particularly photos) in a large, messy file system. I also played around with some PHP code in an identity provider for the PamelaProject."

  • Favorite team: "Um, I'm sports challenged."

  • After hours: "I drive my children around."

  • Favorite hangout: "Red Butte Gardens outdoor summer concert series. Last night was a great blues show with Susan Tedeschi and Derek Trucks."

  • What Olds most recently added to his iPod: "John Butler Trio, Corinne Bailey Rae, and Kenny Wayne Shepherd. But my iPod is mostly audio books. Most recent are the Tipping Point, Blink, and Cesar's Way."

  • PC or Mac? "Linux, almost exclusively."

  • Comfort food: "Very spicy Thai or Indian. Anything with wasabi on it."

  • Ride: "Nissan Pathfinder. It gets me where I want to go."

    — Kelly Jackson Higgins, Senior Editor, Dark Reading

  • Novell Inc. (Nasdaq: NOVL)
  • Google (Nasdaq: GOOG) Kelly Jackson Higgins is the Executive Editor of Dark Reading. She is an award-winning veteran technology and business journalist with more than two decades of experience in reporting and editing for various publications, including Network Computing, Secure Enterprise ... View Full Bio
     

    Recommended Reading:

    Comment  | 
    Print  | 
    More Insights
  • Comments
    Newest First  |  Oldest First  |  Threaded View
    COVID-19: Latest Security News & Commentary
    Dark Reading Staff 6/1/2020
    Stay-at-Home Orders Coincide With Massive DNS Surge
    Robert Lemos, Contributing Writer,  5/27/2020
    Register for Dark Reading Newsletters
    White Papers
    Video
    Cartoon Contest
    Current Issue
    How Cybersecurity Incident Response Programs Work (and Why Some Don't)
    This Tech Digest takes a look at the vital role cybersecurity incident response (IR) plays in managing cyber-risk within organizations. Download the Tech Digest today to find out how well-planned IR programs can detect intrusions, contain breaches, and help an organization restore normal operations.
    Flash Poll
    Twitter Feed
    Dark Reading - Bug Report
    Bug Report
    Enterprise Vulnerabilities
    From DHS/US-CERT's National Vulnerability Database
    CVE-2014-8937
    PUBLISHED: 2020-06-01
    Lexiglot through 2014-11-20 allows denial of service because api/update.php launches svn update operations that use a great deal of resources.
    CVE-2014-8938
    PUBLISHED: 2020-06-01
    Lexiglot through 2014-11-20 allows local users to obtain sensitive information by listing a process because the username and password are on the command line.
    CVE-2014-8939
    PUBLISHED: 2020-06-01
    Lexiglot through 2014-11-20 allows remote attackers to obtain sensitive information (full path) via an include/smarty/plugins/modifier.date_format.php request if PHP has a non-recommended configuration that produces warning messages.
    CVE-2014-8940
    PUBLISHED: 2020-06-01
    Lexiglot through 2014-11-20 allows remote attackers to obtain sensitive information (names and details of projects) by visiting the /update.log URI.
    CVE-2014-8941
    PUBLISHED: 2020-06-01
    Lexiglot through 2014-11-20 allows SQL injection via an admin.php?page=users&from_id= or admin.php?page=history&limit= URI.