April 25, 2005
My second book, Beginning Shell Scripting from WROX, (The “Tech” side of Wiley) is out, (I just received my author copies). You can get it (of course) at Amazon.
It's a collaborative effort, and the other two folks, Eric Foster-Johnson and Micah Anderson did most of the work. I just threw in on the Mac OS X - specific stuff. Also note, the authors don't write the description, so this part:
In addition to Unix and Linux scripting, the book covers the latest Windows scripting techniques and offers a complete tutorial on Mac OS X scripting, including detailed coverage of mobile file systems, legacy applications, Mac text editors, video captures, and the Mac OS X Open Scripting Architecture
is a great example of marketing hyperbole. But, I think it's a good book, and hopefully will be of use to folks. Of course, since I get royalties, and have a 1973 Mustang that I have to slap back out of my wallet constantly, if everyone were to buy a copy for everyone they know, well, I wouldn't cry or anything.
Oh, don't pay any real attention to the biography. I accidently sent them the wrong one, from 2001, and there's very little that applies at this point. But the dedication is correct, and if you're wondering who Randy Millholland is, and why he's mentioned, go here and read his work. It's not for everyone, but it's probably the best writing I've ever seen in a web comic, or a paper one for that matter. If you like it, make with the clickey-click on the PayPal link, and send Randy a sawbuck or two. Nice emails are also appreciated, (However, if you flame him, you may not like the result. He's a good guy, but not to fools.), but nothing says, “You do good work” like money.| Comments ()
April 24, 2005
Microsoft's “Neutral” stance on non-tech issues
So, if you read any of the tech blogs, especially Scoble's, you'll know that the big controversy this week is on Microsoft “suddenly” becoming neutral on non-tech issues. Depending on who you believe, Microsoft suddenly pulled support of Washington State anti-discrimination bill just before it went up for a vote or over a year ago, and they did this in reaction to a threat from a fundamentalist Christian group, or as a bit of “We only support tech issues that make our stock mo' betta” decision - making.
Like most things, there's only about four people that know the real story and most of them aren't talking. (Scoble's got Ballmer's 'Official' comment to Microsoft employees along with his own comments on his blog.) One of the big themes coming out of this is, do companies have any business taking stands on controversial issues that aren't directly related to their business, aka, “If it doesn't directly affect our stock price, we should shut the hell up on it.” There are a lot of reasons for this, all very logical, well - though out, and well - reasoned.
But they're also wrong. Companies, especially ones that are as diverse as Microsoft have a duty to their employees to fight discrimination regardless of the reason, or who it affects, because if Steve B. folds on this, what happens if, say, in ten years, there's a bill that affects the people against gay rights in a discriminatory fashion? Well, what's good for the goose is good for the gander, or, if he's spineless when it suits you, what do you think he'll do when you need him to have a spine to help you?
The “Microsoft should stay out of non-tech issues” crowd is missing a point. At some time, every group, regardless of its members is going to have someone trying to shaft them. Today it's gays. A hundred years ago, it was the Irish, and other immigrants. for over two hundred years, it's been black folks. In the late 1800s/early 1900s, it was women. At one point, being a christian was not a fun thing to be in parts of this country.
All of it is wrong. I may, and I do, disagree with the fundies. To the point that my 'pet name' for fundamentalist christians is, well, “fundies”. It's not a nice thing. I find their platform and their goals to be horrific, short-sighted, and rather reminiscent of the Catholic Church during the Inquisition, or really, any time in the first half of the previous millennium. They scare the hell out of me, because when you have a bunch of religious fundamentalists take over, people like me get shot first, and not in public either. (This viewpoint is not open for discussion. I have too much history on my side. In any totalitarian government, the first thing done is make sure everyone knows that God approves, the second thing is to permanently silence all the people who are able to point out you're full of crap in a cogent manner, and who are never going to stop.)
Fundies have the same right to the same rights as everyone else. The right to let economic and personal factors determine housing choices, instead of trying to find someone who doesn't hate them. The right to not be fired just because the new boss hates fundies. The right to go about their lives without catching shit because of who they are. The same things, oddly enough, that gays want.
We all have the right to those rights, and we have the right to expect that our local governments are going to do their bit to protect those rights. We don't have to like each other. We DO have to let everyone live without fear of being fucked with just because of what you are, or what you believe. I think terrorizing fundies is just as shitty as terrorizing gays.
But what's that got to do with Microsoft? Well, everything. Because Microsoft isn't some entity. It's a hollow shell, only given life and purpose by the people that make up its employee database. If even one of those employees can't do their bit because they're afraid that they're going to lose their apartment because the new landlord hates fags or fundies, the whole company suffers. No one works in a vacuum. (Well maybe Bill does.) That one person works with others, and now they can't do their bit. That person has friends. Now they have to deal with this person's problems because, the fact is, your life affects your work. If you're gay, and you got beaten to a pulp because some twat decided you don't have the right to be gay and alive around them, you're not going to be able to do your job right, and the ripple effect starts. If you wake up to find your car vandalized because PETA decided that you shouldn't wear fur, how good are you going to be in the office for the next week or so?
(Note: Yes, I'm using Fag and Fundie. Neither are pretty words, but they make my point, or help me to. So deal. This is also not a theoretical issue for me. I have deep familial and other personal links to the GLBT community. I cannot be neutral on this issue, not that I would be.)
That's where Ballmer and the rest of the “Only Care about Stock Value Things” crowd falls short. Microsoft is not a stock price. Microsoft is a group of people. Right now, some pretty divided people. There's groups of Microsoft employees that believe, with every fiber of their body, that some of their coworkers are not deserving of the same rights and protections because of who they are. Just how long do you expect them to work together if the message from the top is “We don't care either way”? That's not leadership, that's not guidance. That's sticking your head in the sand. Because you know that at some point, a Microsoft Fundie is going to say, in hearing of a Microsoft Fag, “Well, we won that one”. The best reaction you can hope for is that Fag just not talking to those Fundies ever again beyond a bare minimum in a coldly professional way. Of course, if they're on the same team, well, that team's kinda screwed. But who do you fire? The Fundie is right, they DID win. They may not have won for the reasons they think, but they won on an issue that's very important to them. The Fag who will never talk to that Fundie again beyond the bare minimum is right too. They feel threatened, and hated, and rightly so. They feel that the Fundie wants them to just not exist as a human being any more, and that's pretty correct too. So who do you fire?
Of course, it can get much worse in a vacuum. People quit. People argue, someone may even take a swing at someone else, and have to be disciplined, or even fired. What happens if this conflict is happening between members of a key Longhorn team? What does Steve do then? Let the team fall apart? Fire people? Tell them that when they're at work, they're Microsofties first and humans second? That will just drive it underground. But understand something...one incident, one purely, random, human incident like the one I described and you have a team that just became useless. No company, but especially not Microsoft, can afford that.
But Steve's just said that as a company, Microsoft doesn't care. Unless it is legislation that affects the stock price, Microsoft's official stance is neutral, aka apathy.
What happens when the State of Washington, or the Bush administration tries to push through laws that tell private companies that they cannot provide insurance benefits to partners of gay employees? (This isn't hypothetical, the City of Austin, TX. tried it with Apple once.)
What then? Do they suddenly become not neutral then? Do they think the Fundies will suddenly back their actions if they come out against such legislation? If so, can I have some of their drugs? At what point does Microsoft's leadership realize that they are nothing but a collection of smart people, and they can't afford to allow the government to screw over those people. Even if it pisses off others. What Ballmer cannot see, is that there's no magic compartmentalization here. If you're gay, you're gay first, everything else is second. If you're Christian, you're Christian first, everything else is second. To expect otherwise is unrealistic and not right. Yet that's what Ballmer, evidently, wants from the world. He's going to find out that he's not going to get his way.
I don't envy Ballmer. Not a bit. He's going to lose with one group no matter what he does. If he thinks any different, he's stupid. But I have to look at it this way. If I'm going to piss people off, I'd rather it be for doing something that protects human rights, instead of limiting them. I'd rather piss off PETA by supporting the rights of hunters, since hunters aren't trying to tell you you HAVE to hunt. I'd rather piss off the gun - control folks and support a states-rights interpretation of the Second Amendment, instead of allowing Idaho to decide gun policy for New York, or vice-versa, because that's allowing the people of the state to decide for themselves, instead of some federal committee without a clue. I'd rather piss off the white supremacists and make sure that immigrants and folks that aren't white get a fair shake, because if a part of us are second-class citizens, we all are. I'd rather piss off the FCC and hire Janet Jackson to play at my company party, than make her a pariah over a boob.
I'd rather piss off Fred Phelps than consign members of my family to lives of fear and worry. If I'm going to piss people off, then it's going to be because I'm reaching out a hand to those that need it, not slapping them down. I'd rather follow King and X instead of Wallace and Duke.
Ballmer is trying to avoid making a decision, avoid taking sides. But by doing that, he's already failed. He just can't see it yet.
As to what my personal reaction is going to be to all of this? I...don't know. It's something I'm still thinking of. If I had two-three year's salary in the bank, it would be a lot easier. But I don't, and I have others that I am responsible for. So I can't make the emotional decision, no matter how satisfying. I have to see what happens. Measure twice, cut once. But for what it's worth, I hate that I now have to even think about this kind of thing in conjunction with Microsoft.| Comments ()
April 21, 2005
Web writer get - together at the WWDC?
I really hate the term blogger...and writing is what folks with blogs do, so, it's a web writer get-together.
Anyway, the 2005 Apple WorldWide developer conference is the week of June 6, (the 6-10th to be precise). So, if anyone who does this “Writin' on the IntarWeb thang” wants to get together, meet each other and hang out one night, drop a comment here. I'll wait a few days and see what the response is like, then find a place.
Note that I'm not one for organized functions. I'm much more likely to find a nice cozy dive where we can order pizza, be loud, and have fun.
Anyway, comment if you're interested, and we'll go from there.
There's already one of these going on:
If you can only go to one, go to buzz's, he puts FAR more work into it than I ever will, and should be rewarded.| Comments () | TrackBacks (2)
April 19, 2005
Stupid Mac OS X Server 10.3.9 update bug and probable fix
If you updated to Mac OS X Server 10.3.9, and you suddenly find that people are having real problems with AFP or other services on that server, but they're ketting Kerberos tickets, open up Directory Access on the server and check out the “Authentication” tab.
It will probably have been set to Local Directory/Local Only. It seems the updater changes this setting for you. Of course, that kills all your Open Directory users' ability to oh, use AFP. So you have to reset it back to Custom Path, and then re-add the /LDAPv3/127.0.0.1 domain so everything's copacetic. The combo update doesn't appear to have this problem, and may fix this, but if this is the only problem you're having, try this fix first.
There, now it's in Google, so everyone knows about it.
And I hope there's a QA person at Apple with a VERY large beer tab.| Comments ()
April 7, 2005
An analysis of the Symantec Internet Security Threat Report Brouhaha, or, Jack Cambell is a great honking prat
Yes, I know, it's a rather challenging title, but...well, he is. A great honking prat of a publicity hound, and even though I do know better, I'm going to give him some of what he wants...attention.
However, it remains to be seen if he'll enjoy the experience.
Ol' Jack's been in the news a lot lately. First, there was this little bit of idiocy: DV Forge Virus Prize 2005 Yes, the “I bet you can't make a virus” contest, recently rescinded. Let's take a look at that original press release, shall we? It was a challenge to create a virus that could infect Mac OS X, because according to Jack Campbell,
Symantec Corporation has recently released information to the press suggesting that they believe that the Mac OS X platform is at substantial risk to a new virus infection, and that the principal reason that OS X presently has zero in-the-wild virii is simply the lack of interest by virus coders, due to the platform's comparatively small market share,“ says DVForge CEO, Jack Campbell, ”We recognize that assessment as complete nonsense, and, we have chosen to make a challenge that is interesting enough to grab the attention of any malicious coder... $25,000 worth of interesting. I happen to believe that Apple should be offering this prize. But, since they have not, I will. On behalf of knowledgeable Mac users everywhere, I am putting my money where my mouth is.
Okay, so if you read the report, you realize that it's not a hysterical “MACS ARE GONNA DIEEEEEEEE!!!” thing at all, although Jack the Prat would like you to believe that. But he's good at misleading people for his own gain. Just ask Macintouch or Your Mac Life. The report is a long, detailed look at all internet vulnerabilities between 4 July and 4 December 2004. If you don't need to read it, it's some dry stuff, but since Jack's having a stroke over it, let's take a look at the report, which Jack really doesn't think anyone will do. (As we'll see, he really doesn't want anyone to look at it in detail either, since he'd playing to the ignorant.)
Of course, he's wrong if he thinks no one will read this thing. As my upcoming slogan says, “Argue with me”. I live for this. That, and it's kind of my job. One minor point: I'm not a Symantec fan. Their Mac software has been an unending flow of buggy and dangerous to your data excrement since HFS+ came out, and I'll never voluntarily buy a Symantec product again. Be that as it may, they did a good job on this report, and their Security Response site is a valuable resource. They didn't deserve what Jack and some other sites who should know better are trying to do to them.
First of all Apple doesn't even show up in the report until page 9, and a graph of documented browser vulnerabilities. Safari's barely a blip on it, totaling at most, what looks to be like 5 vulnerabilities, and if you keep up with these things, that's about right. Hardly alarmist. Safari's had some vulnerabilities. So have Gecko - based browsers. Big deal. They don't overstate it. They present the numbers, as a report of this nature should. I think my UK readers should be angrier since they live in the most infected country on the planet. That'll teach them to get snarky about the pound.
Apple doesn't show up again until page 43, in the section on web browser vulnerabilities. Wow, how alarmist. Symantec talks about Safari, a web browser in a section on web browser vulnerabilities. Hardly Hearstian reporting. In fact, Symantec very responsibly states that:
Not every vulnerability discovered is exploited. As of this writing, there has been no widespread exploitation of any browser except Microsoft Internet Explorer. This is something that Symantec expects to change as alternative browsers become more widely deployed.
I guess Jack doesn't like it when a report points out the bleeding obvious, it's not as attention-getting. I bet he especially hates it when the report does so in a way that counters the hysteria he's trying to foment. Even worse for Jack's case that this report is an alarmist bit of claptrap is this section:
Over the last six months of 2004, there were no vendor-confirmed Safari vulnerabilities. This is somewhat surprising given the increasing popularity of Mac OS® X, which is in turn associated with the success of the iPod. In the first half of 2004, there were two vulnerabilities affecting Safari compared to a single vulnerability in the second half of 2003.
The number of Safari vulnerabilities reported so far is too low to suggest any trends. This may be due to an inability of researchers to find vulnerabilities, or it may simply be due to a lack of interest in the browser because of its recent entry into the market and subsequent limited deployment. However, Symantec believes that as the browser becomes more entrenched in the market and as more users deploy it, researchers will continue to find security vulnerabilities in Safari.
I'm missing how this is irresponsible or not true. They list numbers of vulnerabilities, and point out that the low number is surprising. That seems to be a good thing, if you ask me. They even say it may be because researchers (Note that in this report, “researchers” includes bad guys looking for holes to exploit as well as good guys trying to stop them) can't find any vulnerabilities. Read that again, and hear another bit of Jack's case falling into nothingness. Even the last sentence doesn't say that there will be more attacks or Mac virii. It says that Symantec believes that as Safari becomes more popular, researchers will find security vulnerabilities. Not “This will happen, but we believe it will”. So they aren't guaranteeing anything, but saying they think it will happen. As taking a risk goes, that's right up there with saying you predict tension in the Middle East. Jack's not looking too swift here, but that's nothing new.
The next section states:
So far, nearly all reports of vulnerabilities exploited in the wild against browsers are associated with Microsoft Internet Explorer. While there have been few, if any, credible reports of attacks against Mozilla, Mozilla Firefox, Opera, or Safari in the wild, it remains to be seen whether these browsers will live up to the expectations that many have for them.
This strikes me as being more responsible, not less. There are a lot of people who think that if they use a browser that isn't IE on Windows, that they're magically invulnerable to all attacks. They're wrong. This statement is saying that the !IE browsers are going to have to do a lot of work to live up to that belief. Okay, seems reasonable.
The next mention of Safari is here:
As was stated in the previous section, there were no Safari vulnerabilities disclosed between July 1 and December 31, 2004. Furthermore, there were no high-severity vulnerabilities found in Safari in the previous six-month period. In the last six months of 2003, the lone Safari vulnerability was rated high severity. The average severity of Safari vulnerabilities (of which there are only four in the entire vulnerability database) is within the high severity range, though it is skewed by the small sample set and the presence of a single
The bug that note 37 refers to is here: http://www.securityfocus.com/bid/7518, which was fixed long ago. Remember, they're talking about h2 2003, over a year ago.
But it's on page 78, under the heading “Emerging Security Concerns for Mac OS” that we see what has Jack in a tizzy. Now, some context, which Jack couldn't be bothered to provide, because Jack doesn't like context, it makes him look like the prat he is. This is a subsection of a section that starts on page 75 entitled “Future Watch”, and whose opening paragraph says:
The previous sections of this report have discussed Internet security developments between July 1 and December 31, 2004. This section of the Internet Security Threat Report will discuss emerging trends and issues that Symantec believes will become prominent over the next year. These forecasts are based on emerging data that Symantec has collected during the current reporting period. In discussing potential future trends, Symantec hopes to provide organizations with an opportunity to prepare themselves for rapidly evolving and complex security issues.
In case that's not clear, Symantec is saying in this section that they are about to attempt to give IT and other folks some educated guesses at what may happen in the next year. They're pretty clear that this section is a guess, not a prediction or a guarantee. It's a pretty educated, and well-stated guess, but a guess nonetheless, and that it's based on things they've seen thus far. Jack kind of left that out of his little rant in his challenge. Of course, so did Wired, CNN, and about everyone else who reported on this. So let's analyze this section in detail.
Generally speaking, the Macintosh® operating system has been relatively immune to malicious activity, particularly compared to other operating systems like Linux and Microsoft. With the introduction and popularity of Mac OS X, however, Apple® Computer has become a target for new attacks and vulnerabilities. With a newly designed operating system based on a BSD-UNIX lineage, Mac OS X has begun to not only capture the attention of users but of vulnerability researchers as well.
Over the past year, Symantec has documented 37 high-severity vulnerabilities in Mac OS X.108 These vulnerabilities have been confirmed by the vendor, which, in the Apple case, almost always means that the company has released a patch. The appearance of a rootkit109called Opener in October 2004,110 serves to illustrate the growth in vulnerability research on the OS X platform. Additionally, multiple remote and local vulnerabilities111 have been disclosed that affect both the server and desktop versions of OS X.
Again, nothing alarmist here. In fact, it starts off by pointing out the historical immunity of the Mac OS to attack compared to other environments. It then points out how with OS X, Apple is now becoming a target for new attacks. This has been proven, and is undeniable. There's nothing here to say how much more vulnerable, and that could be a mistake, but in a report like this, that's not surprising. The fact is, Mac OS X is attracting more attention, and as things like the root kit have shown, not all of it is good attention. However, none of this is that surprising, nor is it incorrect or inaccurate.
The next paragraph talks about what Symantec has noted in the way of numbers of vulnerabilities over the last year, talking about 37 “high-severity” vulnerabilities. There's some links to the rootkit, aka Opener. (note 109 defined a rootkit:
A rootkit is a collection of tools designed to allow hackers unfettered access to a computer system, often in a manner that avoids detection by others.)
This may be where some of the misunderstandings start. To a lot of people, none of them security types, most of these vulnerabilities aren't a big deal. So QuickTime Streaming Server dies, or you have to reboot. Big deal. Well, to network types, it is a big deal. To network types, almost any vulnerability that allows root access, even if there's no exploit is a big deal. We have to deal with “what if” a lot. In addition, servers that can't stay up, services that die, those are Very Bad Things. So while a home user may only consider something that wipes your hard drive to be critical, to a mail admin, a bug in Postfix like this one...
The sixth issue affects the Postfix functionality on Mac OS X 10.3.X desktop and server. This issue may allow an attacker to send mail without requiring authentication. This issue has been assigned CVE ID CAN-2004-1088 and is resolved in the attached security update.
...is a very big deal, because it would allow someone to turn your email server into a spam-bot. If you're ignorant of what is actually being talked about, (and past experience shows Jacko...sorry, Jack to definitely be a bit of an IT ignoramus), then Symantec looks to be blowing this out of proportion. But so far, they really aren't. They're pointing out that Mac OS X is not perfect by any means. That's just common sense, or at least it should be. Another paragraph that would look very different to a home user and a network admin:
Vulnerabilities in the Apple windowing system and development kit and in the Apple default Apache configurations are two of the nine vulnerabilities (not all of which were high severity) for which Apple released patches. The various OS X vulnerabilities allow attackers to carry out information disclosure, authentication bypass, code execution, privilege escalation, and DoS attacks.
This could be taken to mean that Symantec is insinuating that there's bad stuff happening RIGHT NOW, QUICK! GO BUY NAV!! While I'm sure that they'd love for Mac users to go buy Norton AntiVirus, (NAV), that's not what this says. It says that these vulnerabilities allow the mean people to do mean things. Nothing more, nothing less. It doesn't say, nor insinuate that anyone has done something mean, but that these vulnerabilities allow bad stuff to happen if they are left unpatched. That's the truth, plain and unfettered. Jack, and a lot of people need to start reading things as they are, not as they'd like them to be. Of course, then he wouldn't get all this juicy publicity.
On to the really popular paragraphs:
Contrary to popular belief, the Macintosh operating system has not always been a safe haven from malicious code.112 Out of the public eye for some time, it is now clear that the Mac OS is increasingly becoming a target for the malicious activity that is more commonly associated with Microsoft and various UNIX-based operating systems. Symantec believes that as the popularity of Apple’s new platform continues to grow, so too will the number of attacks directed at it.
Well, this is correct. The Macintosh has not always been a safe haven from malware. In fact, in the System 6/System 7 days, it was a prime target. System 7 re-architected the Desktop functionality just to shut down some of the more popular virii. I remember not being able to use any disks from my school without the familiar sound of SAM screaming its bloody head off. So not only was the threat real, but it was real enough for Apple to create what was, in effect, a patch so that a malware vector would be eliminated.
Even into the Mac OS 8/OS 9 days, while the number dropped, it wasn't zero. Anyone remember the QuickTime worm? Yeah, that about sucked, didn't it. The last one of note pre-OS X was the Simpson AppleScript virus, which was kind of annoying, but that's about it.
Into Mac OS X, you've had none of the “infect your system without you doing anything” kind of virii, but trojan horses? They're there. The recent Opener rootkit? That was a trojan my friend. The very lame P2P Microsoft Office 2004 trial malware that wiped your home directory? Trojan. Both of those were in the last year or so, and they were the first attempts on OS X in a long while. So yes, that's an increase. So far, Symantec's technically correct on both points.
The fact that both of these are trojans is to be expected. The fact is, writing malware that needs no user action whatsoever has gotten harder, so malware writers are turning to trojans and social engineering to get their work done. In fact, the report notes that trojan incidents are on the rise. That would be what the laymen would call a big “Well DUH”.
But again, note what Symantec hasn't said yet. They haven't talked about virii. They have talked about malicious code. That's not alarmist, that's fact. There is malicious code targeted at Mac OS X. Jack can scream and cry and have a total BF all day long, but it's still a fact. Symantec is simply pointing that out, and pointing out, (correctly), that Mac OS X is, due to its growth, becoming more of a target for malware. No one sane can deny that.
Onto the next paragraph that everyone jumped on:
The market penetration of Macintosh platforms will be accelerated by the much lower priced Mac® mini, which may be purchased by less security-savvy users. As a result, the number of vulnerabilities can be expected to increase, as will malicious activity that targets them. However, it should be stated that while the number of vulnerabilities in Macintosh operating systems is expected to increase, they will likely be outnumbered by vulnerabilities in other operating systems for some time to come.
Symantec's saying that the Mac Mini's price makes it a more attractive computer for the cost - conscious, less tech - and security - saavy user. No foolin', really? Although I would argue that IT folks love it too, we aren't who it's targeted at. It's targeted at the low end buyer, and Symantec characterizing them as being less security - saavy is pretty darned spot-on. They then say that more people using the Mac OS means that more vulnerabilities will be discovered. Again, DUH. Not only is that to be expected, it's one of the reasons for using Open Source in Mac OS X to begin with. So that more people look at your work, and find bugs sooner. However, even in the last sentence, Symantec continues being ruthlessly reasonable by pointing out that even though the number of vulnerabilities will increase, the situation on the Mac is still going to be better than other platforms for a good while longer.
Pray tell Jack, what's the problem here? Again, there is none. Part of the problem is that this report was written for people like me, who run networks, not prats who run their mouths like Jack. If you read this report with a bit of real knowledge and experience, it's saying nothing new to the Mac IT manager. But, hey, Jack hadn't been in the press lately, and virii are always a good hot - button issue. So he jumps on this, distorts it, and gets a lot of press. Even looks like a hero, instead of the tool he really is for distorting this issue so badly. I guess he was bummed he couldn't get on the Terri Schaivo bandwagon.
That's it by the way. That's all the mention of Mac OS X in the entire report. A blurb on Safari in a section on web browsers, and a few, rather reasonable paragraphs on Mac OS X future possibilities in a Future Trends section. So if the report is so calm, what's the deal? Why did Jack, Cnet, Wired and the rest jump on it this way?
Well, for the not - Jack participants in this idiocy, it's called, “You never lose hit counts by pissing off Mac users”. If you selectively quote things, so that you get the MacMacs annoyed, your hit counts go up, and you can use that to attract new readers, advertisers, and you make what we in the trade like to call money. This shameless manipulation of MacMacs I get. It's fun, in a sick way. What I don't get is how they got away with doing it so transparently. For example, here's ZD Net Austrailia's quote from the Symantec report:
“Apple Computer has become a target for new attacks… The appearance of a rootkit 109 called Opener in October 2004, serves to illustrate the growth in vulnerability research on the OS X platform… The various OS X vulnerabilities allow attackers to carry out information disclosure, authentication bypass, code execution, privilege escalation, and DoS attacks. Symantec believes that as the popularity of Apple’s new platform continues to grow, so too will the number of attacks directed at it,” the report said.
Here's the CNN Money version of the same paragraph:
The market penetration of Macintosh platforms will be accelerated by the much lower priced Mac mini, which may be purchased by less security-savvy users,“ the report said. ”As a result, the number of vulnerabilities can be expected to increase, as will malicious activity that targets them.
Finally, the Wired version:
The market penetration of Macintosh platforms will be accelerated by the much lower priced Mac mini, which may be purchased by less security-savvy users,“ the report said. ”As a result, the number of vulnerabilities can be expected to increase, as will malicious activity that targets them.
(If the Wired and CNN versions look identical, that's because they both parrot the same Reuter's feed story. Great journalism there guys. Nice fact checking. Way to be the mouthpiece.)
Now, again, the full paragraph from the report:
The market penetration of Macintosh platforms will be accelerated by the much lower priced Mac® mini, which may be purchased by less security-savvy users. As a result, the number of vulnerabilities can be expected to increase, as will malicious activity that targets them. However, it should be stated that while the number of vulnerabilities in Macintosh operating systems is expected to increase, they will likely be outnumbered by vulnerabilities in other operating systems for some time to come.
See how easy it is? By dropping one sentence, and ignoring context, we can completely misrepresent what the report said and implied. Isn't manipulating the lazy fun? Because that's what they, and Jack, were counting on. That we, the people who aren't them, are so lazy as to not bother to read the data they're quoting. I'm just cantankerous and ornery enough to not only do just that, but also spend a couple hours writing an article pointing out their misdeeds. I'm that kind of guy. Yes, I'm cackling as I do this. It's been a tedious week, I need the release.
But what about Jack?
Okay first, he's been engaging in a bit of proactive reputation - rebuilding. Jack's been involved in some seriously shady stuff before, (read Macintouch or listen to YML for details.) and this was suddenly a prime opportunity. People were angry. Outraged. Wired and CNN and the rest gave him a perfect set. All he had to do was spike it, and he did, with style. He set himself up as “Jack Campbell, ferreter of untruths, and challenger of evil corporate lies”. But don't kid yourselves. This is a cold, shameless manipulation of public sentiment, in the grand style of Hearst, McCarthy, Smathers, and a rich line of such amoral publicity hounds.
The best proof is in Jack's own words:
This challenge is to John Thompson, CEO of Symantec corporation, and is based on statements issued by his company in and in response to its Internet Security Threat Report, issued in March.“ said Jack Campbell, DVForge, Inc. CEO, ”The report and the several following statements issued by Symantec representatives very cleverly used vague assertions and innuendo to promote the idea that an in-the-wild, self-replicating virus that is effective against the modern Mac OS X operating system is possible, and is in fact a serious threat to Mac users. If anyone in my company made such dangerously erroneous public statements, I would fire them on the spot. Since I cannot fire anyone inside Symantec, I am specifically challenging Mr. Thompson to either produce scientifically valid evidence that such a Mac OS X virus is possible, or to publicly retract his company's claims.
Jack should not only be fired, but also get a kick in the arse for that kind of crap. I think a certain internet radio host would be willing to help me out with that too. Again, review the whole Mac OS X Section Jack is waving as his banner. Go ahead, I'll wait. Guess what word isn't there? That's right. Virus See, Symantec didn't say there was a virus. They didn't say there wasn't either. They said, basically, that as the Mac OS gets more popular, you're going to see more people trying to find vulnerabilities in it. They never talked about any actual implementation of an attack save the one we all know about, Opener. The report neither used “vague assertions” nor “innuendo” to promote anything. Jack's insistence that a Mac OS X virus is impossible shows that as an authority on technical issues, he's a great publicity hound. But if you're going to ask Jack about tech issues, ask the cat too, as a second opinion. I bet you get a better answer from the cat. Symantec doesn't set odds, they just say what is pretty obvious. The more people use OS X, the more bugs, and therefore, vulnerabilities you'll find in it. This has shown to be true over time with any OS, and Mac OS X blazes no new ground here.
Jack didn't do this because he cares, or because he's some bastion of integrity. He did it to be the good guy. He's got this company, DVForge, and this company sells stuff to Mac users. Jack knows one thing about Mac users. If you look like a good guy to them, they'll buy your crap. So, he looks like a good guy for standing up to “Teh Eeeeeevul Slimantec” and hopes that Mac users do what they always do, and buy his crap.
Don't fall for it. He's jamming you with noise so you can't see the truth.
Don't even take me at face value. I gave you the link to the report. Download it and read it. It's fascinating stuff, even for the non-Mac parts. It can be kinda dry too, so if you don't make it through the whole thing, I understand. But please, don't fall for Jack's shuck and jive. Prove that you're smarter than that, and that you too realize that Jack Campbell is a great honking prat.| Comments ()
April 3, 2005
Wireless Networking and Airport
Wireless Networking and The AirPort
Apple and Lucent redefine easy networking with the AirPort, and 802.11
This article covers Apple’s AirPort, the wireless networking system introduced in July at MacWorld Expo, as well as the standards and technology behind the AirPort. Along the way, we’ll look at other wireless networking schemes and products, to see how they stack up against the AirPort. We’ll start with a basic introduction to the AirPort, and its connection to the iBook, and to other members of the Macintosh family. We will also go into a basic history of wireless networking, as it pertains to the AirPort and the 802.11 standard. We’ll also take a close look at the 802.11 standard itself, and some of the work Lucent Technologies has done to get the speed and capabilities that now exist out of that standard. Next we’ll take a look at some of the power management and other features that are integral to the Lucent work. Then we’ll look at the AirPort itself, and see how Apple has applied their philosophy of “It just works” to wireless networking. Finally, we’ll compare the AirPort and 802.11 to some of the other wireless networking schemes.
The biggest news to come out of the New York MacWorld was the iBook, and its wireless networking capabilities. Although I have no doubt the iBook will become as much a success as the iMac, I think the really astounding part of this announcement was the AirPort, Apple’s release of an 802.11-compliant wireless networking system. The AirPort is a one-stop wireless networking system that runs at common Ethernet speeds. It is cheap enough to become an impulse buy for iBook, and other Mac customers.
Now for the iBook, the AirPort is a great enhancement. The iBook’s card, which, in classic Macintosh fashion, is insanely easy to install, is about a hundred bucks; then add about 300 bucks for the AirPort Pod, which is the base station for AirPort-enabled Macs; a person or company can set up a fast, reliable, easy to use and maintain wireless network in relatively short order. Even for other Macs, the AirPort is as much of a blessing. With PC cards available, and more on the way from Apple and other vendors, such as Farallon, and PCI cards for the tower and desktop Macs, even non-iBooks can take full advantage of the AirPort. (Although not mentioned, I’ll hazard two predictions about the iMac. The first is that we will be quickly seeing a USB-connected AirPort device, and the second is the iMac will eventually have AirPort networking built-in.)
The extra plum in this bowl is the IEEE 802.11 wireless networking standard. Since the AirPort is based on this standard, any computer with an 802.11-compliant interface device can plug into the AirPort network with no more trouble than connecting Macs and PCs or Unix workstations via conventional Ethernet. So much of the AirPort technology is based on the 802.11 standard, we shall go into the history of 802.11 devices and the details of the standard itself.
The IEEE 802.11 Specification
Let’s start with some background information on the foundation for the AirPort, the IEEE 802.11 standard. This standard, , defines the way that 802.11-compliant devices communicate with each other. It operates at the physical, or hardware layer, and the Media Access Control, or MAC layer. It is not concerned with TCP/IP or AppleTalk, but rather the underpinnings. 802.11 defines wireless networking across a number of bands, or frequencies. These frequencies, in the Industrial, Scientific, and Medical, or ISM bands, range from just over 900MHz to approximately 5.8 GHz. The ISM bands were chosen because of their worldwide availability. In practice, due to differences of availability worldwide, 802.11 is primarily concerned with the 2.4 to 2.5 GHz bands. The differences in band availability, power usage, and modulation rules in various parts of the world are shown below in Table 1.
Table 1. Frequency bands and power levels for wireless LANs.
Maximum RF power level
Rules for DSSS and FHSS
U.S., Canada,1 and Latin America (FCC Part 15,247)
1W (at ERP,2 and maximum 6 dBi antenna gain)
DSSS: Receiver processing gain >10 dB
FHSS: 75 hops or more
(ETS,4 300 328)
100 mW (at EIRP,5)
DSSS: Power spectrum density maximum 10 mW/MHz
FHSS: 20 hops or more
Japan (MPT ,6Ordinances 78 and 79)
DSSS/FHSS: Power spectrum
density maximum 10 mW/MHz
1) In Canada, not the 5,750–5,850-MHz band
2) In France/Spain, only the 2,445–2,483.5/2,475-MHz band
3) ERP-Effectively radiated power
4) EIRP-Equivalent isotropically radiated power
5) ETS-European Telecommunication Standard
6) MPT-Ministry of Posts and Telecommunications (in Japan)
As we can see, the 2.4 GHz band is the only one implemented worldwide. The 802.11 standard only is concerned with the MAC and physical layer parts of wireless networking. For those of you unfamiliar with the layers of networking, in general, a complete network stack, or system, is visualized as having up to seven layers. Each layer sits on top of the other, and receives information from the layers above and below, and passes information the same way. The MAC layer sits on top of one or more physical layer systems, as shown below in Figure 1.
Figure 1 The physical layers handle the actual connections and transmitting/receiving of electrical or optical signals that represent data.
802.11 Physical Layer
The physical layer of 802.11 is where the bits hit the wire. It is concerned with how transmission and reception of data happens, and how data is encoded into the corresponding RF signals by the transmitter, and decoded by the receiver. There are three implementations of 802.11: Infrared (IR), Frequency Hopping Spread Spectrum (FHSS), and Direct Sequence Spread Spectrum (DSSS). The IR implementation uses infrared light to move data, much like a television remote, and the last two are radio frequency, (RF) implementations.
Infrared - IR
The IR 802.11 implementation is based on diffuse IR. Rather than trying to line up the transmitter and receiver, like a television and its remote, an IR-based 802.11 device transmits a wideband, or diffuse signal at the ceiling, which reflects the data around the area until it reaches its destination. Likewise, incoming data is bouncing off the ceiling. While better than narrow-beam IR, this implementation can only be used indoors, and requires the ceiling to be reflective to its wavelength, which is in the 850 to 950 nm range. In addition to the ceiling material requirements, 802.11 IR only has a range of about 10 meters, which makes it suitable for a small room, say, such as a work area with an IR-enabled printer.
802.11 IR supports 2 data rates, 1Mbps and 2 Mbps. At the 1Mbps rate, the data stream is broken into quartets. Each quartet is then encoded into one of sixteen pulses during modulation and transmitted. This modulation technique is called 16 Pulse Position Modulation. At the 2Mbps rate, the modulation is somewhat different, with the data stream being divided into data bit pairs, and each pair being modulated into one of 4 pulses.
Frequency Hopping Spread Spectrum - FHSS
FHSS systems break up the total bandwidth into narrower sub–bands, or channels, and hop from channel to channel during transmissions. As the signal hops, it sends a packet at one frequency, then hops to the next channel, and sends another packet, and so on. The FHSS signal dwells on each band a predetermined amount of time. In the case of 802.11, the time is up to 300msec. The hopping sequence is pseudo-random, (computers can’t generate true random sequences, but they can come very close, hence the term pseudo random.) The sequence and pattern of the frequency hops are partially determined by the geographical location. For example: Japan specifies three sequences with four patterns, Spain specifies three sequences with nine patterns, France specifies 3 sequences with eleven patterns, and the U.S. and the rest of Europe use three sequences with 26 patterns. This frequency-hopping also has the serendipitous side-effect of assisting with the collision avoidance process. Since the signal is transmitted on any given channel for a fairly short period of time, collisions happen less often. Within the overall bandwidth are a number of 1MHz wide channels, the number of which depends on the locality of the system. In Japan, there are 23 of these channels between 2.473GHz and 2.495GHz, whereas in the U.S. there are 79 channels between 2.402GHz and 2.48GHz. Another important item in the FHSS algorithm is all available channels must be used before a repeat use of a channel. The FHSS transmitter converts the bitstream from the transmitting device to a symbol stream, where each symbol represents one or more bits. The signal is modulated via a Frequency Shift Keying (FSK) method, with the specific type of FSK depending on the number of modulating frequencies desired. If two modulating frequencies are used, then binary FSK is used, and if four frequencies are used, then quaternary FSK is used. This FSK-modulated signal is what hops frequencies during the data transmissions and receptions. 802.11 FHSS uses a third type of FSK modulation, Gaussian FSK. Finally, although the Gaussian FSK used by 802.11 FHSS gives higher bitrates in its channels, it has more sensitivity to noise and other poor conditions. (Interesting historical tidbit: Spread Spectrum using frequency hopping was invented in 1940 by actress Hedy Lamarr when she was 26.)
Direct Sequence Spread Spectrum - DSSS
The final 802.11 physical implementation is DSSS. This is the implementation used by Apple, Lucent, Farallon and others to create 802.11 wireless networks. DSSS differs from FHSS – instead of subdividing the bandwidth into channels and switching between them, DSSS spreads the signal across the entire bandwidth, thereby increasing bandwidth utilization. As in FHSS, bitstreams are converted into symbol streams, with each symbol containing one or more bits. The number of bits is determined by the modulation technique used, however unlike FHSS, DSSS bases its modulation on Phase Shift Keying, or PSK. The PSK-modulated symbol stream is converted to a complex-valued signal, which is then fed into a spreader chip. The spreader chip multiplies this signal with a pseudo-noise, PN signal, called a chip sequence. 802.11 DSSS bases its chip sequence on the eleven-chip Barker sequence. The Barker sequence is just a series of positive and negative values that is used to force transitions in the signal. For example, you have a pulse that looks like Figure 2.
Figure 2. Basic Pulse
If you modulate that signal with the following sequence:
and you invert the pulse on every transition, (going high if it was low, going low if it was high), and keeping state if no transitions are called for, you get a modulated pulse that looks like Figure 3.
Figure 3. Sample Modulated Pulse
Although the pulse seems to be out of sequence for the last half of the pulse, the sequence starts over once the 11th key is used, so although the last key is a –1, and the first key is a +1, this is a restart/reset, not a transition. No phase shift occurs until the second key, which is a –1, and a transition. Spreading the signal on this sequence makes the total occupied bandwidth larger, and brings the effective bandwidth up to 11 MHz from 1 MHz, while still allowing fallback to 5.5, 2, or 1Mbps if needed. Spreading the signal also makes it less susceptible to interference, as to completely block the signal, the interference must occur across the entire band. However, spreading also reduces overall transmitted signal power, as the output power is applied over a wider bandwidth. Both effects are shown in the diagram below, with signal strength as the y-axis, signal bandwidth as the x-axis, data in blue, and noise in pink.
The outputs of the spreader are then fed into a quadrature modulator, and then into the transmitter front end. 802.11 DSSS specifies 2 bitrates: 1Mbps using Binary PSK, BPSK, and 2Mbps using Quadrature PSK, QPSK.
FHSS v. DSSS
In comparing FHSS and DSSS, we notice that DSSS has some immediate advantages over FHSS. The first is more robust modulation, and greater range, even when operating at half the signal strength of a comparable FHSS system. While the channel-hopping behavior of FHSS gives it more overall frequencies, interference between adjacent channels limits the total number of collocated FHSS systems. However, FHSS does have an advantage over DSSS because it degrades more gracefully than DSSS, and can work better under worse conditions. Much of this advantage is due to FHSS not being spread out like DSSS. Since the FHSS signal is concentrated across a much narrower bandwidth, its amplitude is greater, and FHSS can therefore ‘punch through’ interference better. Also, the hopping aspect of FHSS assists with frame collision avoidance. These advantages are minimized by the fact that DSSS works reliably at much greater distances than FHSS, as shown in Figure 5 below.
Figure 4 Probability of a reliable link for DSSS vs. FHSS
Another advantage to DSSS is efficiency. DSSS is able to give better performance with fewer access points than FHSS., Plus, FHSS reaches a point of diminishing returns much faster than DSSS, as shown in Figure 6.
Figure 5 Throughput efficiency
In addition, DSSS can use a higher number of access points to get an overall higher aggregated bandwidth than FHSS.
Figure 6 Throughput as a function of the number of access points
Also, in collocated networks, DSSS gives higher speeds with fewer access points than FHSS.
802.11 MAC Layer
Now that we have taken a look at the physical layer of 802.11, let’s move on to the next part of the standard, the Medium Access Control or MAC layer. As a wireless network standard, the MAC for 802.11 is different from the MAC for a wired network such as Ethernet. One example of this is the expectation that 802.11 Access Points (AP) are always acting as bridges between the wired network, and the wireless network, which is not an assumption in wired networks. Plus 802.11 frames have some unique features that assist in wireless data transmission and reception. Each frame has sequence control and retry fields that help to minimize interference between stations. Since RF is omnidirectional, regardless of which AP a particular end node is connecting to, its frames are received by every AP in range, so the sequence control fields help deal with this. In conjunction with the sequence control fields, you have the type/subtype and duration fields, that help ensure reliable communications with ‘hidden’ stations. The sequence control fields also work with the fragmentation fields, which allow each frame to be further subdivided into smaller fragments if conditions are bad. There are also To DS and From DS fields that assist in setting up and use of single-channel wireless backbones.
Carrier Sense Multiple Access/ Collision Avoidance - CSMA/CA
802.11 uses a MAC scheme that is similar to Ethernet’s CSMA/CD, called CSMA/CA. The main difference is that 802.11 practices collision avoidance (CA), as opposed to Ethernet’s collision detection (CD). The reason is that in a distributed wireless network, it is highly impractical to attempt to detect collisions, because a weak incoming signal could either be a frame or noise. The CA in 802.11 is designed to avoid collisions entirely. It reduces the chances for a collision during the period of time that has the highest probability of a collision, which is the time just after a station stops transmitting. At that point, many other stations are waiting for access, and will attempt to transmit their data. To avoid collisions, 802.11 uses a random back-off arrangement.
Figure 7 CSMA/CA diagram
As shown in Figure 8, after the busy medium period, there is an Interframe spacing period (IFS), which for 802.11 is 50µsec. All devices on the segment must wait for that IFS period. Following the IFS, devices wait an additional random number of 20µsec slots, the number of which is determined by a binary exponential backoff algorithm. If after this time has passed, the medium is still free, (no other stations transmitting), then the stations can attempt to transmit. Each station uses its own random, (actually pseudorandom) amount of wait time, the chance of a collision is reduced. If a collision is detected, the devices go back into the slot time wait mode, until the medium is free. Another difference is in the frame acknowledgement. Although most LAN systems require some form of frame reception acknowledgement, the wireless nature of 802.11 forces some unique requirements in this area. As with other LANs, 802.11 does all its frame acknowledgement at the receiving end. However, unlike most LANs, 802.11 handles this at the MAC layer, whereas other LANs handle this at higher layers. The reason is the timing requirements imposed by 802.11. With the IFS lasting for only 50µsec, the receiver is required to send an acknowledgement within 10µsec, only after verifying the CRC for the frame. By performing all of these functions within 10µsec of receiving the frame, the receiver can immediately send the acknowledgement, because other stations are still in the IFS period, and the medium is clear. However, these response times preclude handling the acknowledgement at a higher layer, hence the MAC layer acknowledgement. This speed becomes critical in certain topologies, which we will discuss later. A general diagram of the acknowledgement, (ACK) behavior is shown below.
Figure 8. Acknowledgement (ACK) Behavior
At the beginning of the MAC section, I mentioned different 802.11 frame fields, and how some of them are used to deal with hidden stations. Hidden stations are somewhat unique to wireless networking. Unlike wired networks, where every station on a LAN has an almost direct connection to any other station on the same LAN, the transmit range limitations for wireless can result in two nodes in the same cell that cannot physically see each other. An example of this is an AirPort cell within the 150’ range of each node and AP. Node A is 150’ from node B, which is 150’ from the AP, but 300’ from node A. The only way that nodes A and B can communicate with each other is through the AP, as they are ‘hidden’ from each other, as shown below.
Figure 9 Invisible node problem
In this case, nodes A and B could easily transmit at the same time, causing collisions. The solution is the combination of the To/From DS fields and 802.11’s use of Clear To Send/Ready To Send frames. The To/From DS fields tag which way the frame is headed, unlike Ethernet where only the origination and destination MAC addresses are used. In the CTS/RTS system, B sends the AP a RTS frame, signaling the AP that B is ready to transmit a frame. Included in this frame is a time value that represents the amount of time takes B to transmit the data frame. The field that holds this data is the length field, shown below.
Figure 10 Field diagram
Node B then goes into a wait mode. As soon as the IFS and backoff period passes, the AP broadcasts a CTS frame for B, but received by all stations in using the AP. This CTS frame has the same time value that was in the RTS frame. All stations that aren’t B receiving this frame immediately cease transmitting for the amount of time in the CTS frame. Once B receives the CTS frame, it begins transmitting its data frame. The first diagram below illustrates this process in a basic way, and the one following shows a more detailed view of the RTS/CTS structure in conjunction with the CSMA/CD backoff behavior.
Figure 11 RTS/CTS flow
Figure 12 RTS/CTS diagram
One of the other benefits of RTS/CTS, besides avoiding congestion, is that the 802.11 implementation incurs a relatively low overhead. In the example below, even in a ‘pure’ RTS/CTS environment, the throughput is only reduced about 13% over an environment with no RTS/CTS.
Figure 13 RTS/CTS impact on speed
The low impact of RTS/CTS on throughput, along with its collision reduction capabilities, make it a very attractive feature to look for in an 802.11 product, although the RTS/CTS feature is optional under 802.11, and can be removed for cost savings.
Miscellaneous 802.11 MAC features
Another feature of the 802.11 MAC is fragmentation, which is a technique for dealing with poor transmission conditions. Unlike wired LANs, 802.11 networks must deal with things like interference from nearby antenna, or microwave sources such as mobile television transmission units. To overcome interference, 802.11 allows a frame to be fragmented, or split into smaller chunks. (See Figure 15 below.)
Figure 14 802.11b fragmentation
Since fragments are smaller, they allow both end nodes and APs to recover more quickly from both transmitting and receiving them. In addition, the smaller fragment size means that errors in fragment exchange have a lower overall effect on data throughput. This is also assisted by the fact that the frame is not considered to be sent until all fragments have been sent and ACK’d. Thus the sender of the fragments has control of the medium for that period of time. Finally, in the case of interference such as microwaves, the interference itself is ‘bursty’, so the smaller fragment size means the fragments handle this type of interference better. 802.11 requires fragmentation support on receivers, but it is optional on transmitters. 802.11 also allows for dynamic fragmentation, to suit the nature of the interference encountered. By allowing for the possibility of full-time fragmentation, the vendor can build its receiver cheaper, by avoiding the cost of adding enhanced fragmentation support. However, since fragmentation means more transmissions, the overhead is higher, and can reduce throughput.
Roaming is another important part of 802.11. Roaming is not a requirement, but it is an important feature to corporate 802.11 customers. It is usually left out of 802.11 devices, to reduce cost, as in Apple’s 10-User AirPort pod, (which is designed for home and school use, where roaming is not necessary), i One major advantage to roaming is for laptop users going from meeting to meeting in different areas of a floor or building. In a wired setup, the user must either power off, or sleep the laptop, and disconnect the network wire. They must then reverse this process at their destination,. In 802.11 roaming, the laptop is put to sleep, carried to its destination, and woken back up. The 802.11 device in the laptop connects to the nearest AP, and reinserts itself on the network. The actual procedure that allows this to happen is not much more complicated.
In an 802.11 network, each AP sends out regular beacons, (around every 100msec) to all end nodes in range. Included in the beacon are such data as a current timestamp, (for any needed synchronization purposes), a map of current traffic, and supported data rates. Upon receiving this beacon, each end node can judge the clarity and strength of the signal and use it to determine whether or not to attempt a connection to the AP, or if another AP, (if multiple APs are being used) would be a better choice. An end node can send out a beacon of its own, or a probe request message to any APs in range, which then respond with a probe response message, or solicited beacon. In either case, the end node, not the AP, determines the communications quality (CQ) of the signal from the AP, and uses the CQ level to determine which AP would make the best connection. If the CQ of a connected AP signal drops below a certain threshold, (which is determined by a number of factors, including vendor design, usage, speed, etc.), due to either interference, outage, or our roaming laptop above, the end node actively searches for a new AP. Once a new AP is found, the end node moves into a handover state, and reassociates with the new AP. The new AP communicates with both the end node, and the end node’s previous AP to re-establish the end node’s place on the network. The APs use an inter-access point protocol to inform each other of handovers and roaming end nodes. This allows 802.11 networks that use MAC address authentication to hand over that information from the old AP to the new AP, thereby allowing the network to prevent unauthorized roaming, (via the use of MAC address/password tables, etc.). Although a way to easily move a laptop from room to room, roaming is also handy for PDAs and other handheld devices. For example, a 802.11 handheld computerized chart with roaming would allow medical personnel to easily move from patient to patient, without having to re-connect if they moved out of an AP’s range. As noted earlier, Apple’s 10-user AirPort Pod doesn’t support roaming, although Apple recently announced a 40-50 user Pod that would support roaming. The roaming features of 802.11 are specifically supported by companies such as Lucent, Digital Ocean, and Aironet, (who helped developed the InterAccess Point Protocol), Apple, IBM, and other companies. This helps companies thinking about building an 802.11 system avoid being tied to one vendor for roaming support, and is critical in 802.11’s acceptance.
Finally, the 802.11 MAC has certain security features, to help prevent unauthorized ‘guests’ on a wireless network. First of all, DSSS itself makes snooping difficult. The data is encoded and spread across an entire band, any snooper must have the 11-chip Barker code used for a given LAN, and has to be able to re-assemble the signal, which requires them to cover the entire portion of the 2.4 GHz ISM band being used. Also, 802.11 allows for data transfers to be encrypted using a 40-bit RCA key. Although not the best key length available, the 40-bit key was chosen because of the complete lack of U.S. export restrictions on encryption technology based on that key-length. Regardless of the key length, between the DSSS characteristics and the RCA key encryption, 802.11 signals are at least as secure as data traveling over a wired network, with the same encryption.
802.11 supports three basic topology schemes, Independent Basic Service Set, (IBSS), Basic Service Set, (BSS), Extended Service Set, (ESS). IBSS is an ad-hoc peer to peer topology. There is no dedicated AP acting as a central point, and is limited in size and scope. IBSS would be used in a situation where a temporary connection was required between a small number of computers. BSS is the more common topology used for 802.11 networking. This is also the common arrangement for a single cell within a larger network. BSS uses a dedicated AP that is the logical server for the cell or wireless LAN (WLAN). All node communications go through the flow through the AP, which can be connected to a wired network. In this case, the AP acts as a bridge for the wired to wireless networks. ESS is the final, and largest topology of 802.11. An ESS topology consists of multiple BSS cells connected by a wired or wireless backbone. The cells can either be on the same channel or multiple channels. If the cells are on the same channel, then the overall bandwidth is shared by all cells on the backbone. If multiple channels are used, then the aggregate bandwidth is boosted. In the case of an ESS topology, 802.11 has certain specific features that increase its usefulness as a backbone technology. Normally, for an AP to act as a backbone node, it would need a separate transmitter for each cell it was bridging. This would quickly make wireless backbones too expensive to use. 802.11 circumvents this by allowing single-channel frame forwarding. If the AP receives a frame for a station it can’t see, it forwards the frame to any other APs it can see that aren’t the one that sent it the frame. This is an economical solution with good performance characteristics, although like any single channel backbone, overall bandwidth can be a limiting factor.
Power Management Support
Since the majority of wireless LAN users are mobile devices, 802.11 includes specifications for power management support. When a station transmits a frame, that frame contains a power management, PM bit. That bit indicates the station’s current power management mode. If the PM = PS, then the station is in power saving mode, and if the PM = A, then the station is in active mode. In a network using access points, such as the AirPort Pod, the access points uses the status of the stations to determine traffic management for the stations. If the station is in PS mode, then the access point will buffer any messages for that station. On a regular basis, for example, every 100msec, the access point sends out a beacon frame. This frame contains the addresses of the station(s) for which the access point is buffering messages. The stations come out of DOZE mode, (a.k.a. sleep) on a regular basis, based on the beacon frame timing. The station(s) read the beacon frame, and check for buffered messages. If the frame indicates that the station has waiting messages, the station stays in the AWAKE mode, and polls the access point for its buffered messages, at which time those messages are sent. This is how power management works for unicast, or station specific messages.
In the case of multicast messages, or network-wide messages, there is a different procedure. For multicast messages, there is a change to the beacon frame. At a predetermined multiple of the unicast beacon transmission time, another field in the beacon frame is used to indicate that there are multicast messages being buffered. Once the multicast-beacon has been received, the multicast messages are immediately sent. When a station receives a beacon frame showing multicast messages being buffered, it stays in AWAKE mode to receive the multicast messages. An example of a queuing structure used by an 802.11 access point, the WaveLAN from Lucent is shown in the diagram below. All stations that aren’t B receiving this frame immediately halt all transmission
Figure 15 Power Management diagram
The frame transfer block is the only section that works directly with the RF section. The frame transfer has two input queues, normal transmit and priority transmit. The priority queue is used to schedule internal management and control protocol frames, and the normal queue is used for data frames coming from higher layers in the networking stack, such as user-generated data. There is a single multicast queue for all stations connecting to this access point, and an individual unicast queue for each station as well. When polled by a station, the message at the head of that stations unicast queue is passed directly to frame transfer for highest priority transmission. When a station that was in PS mode, (PM=PS), sends a message, (not a poll), to the access point that shows it is now in A mode, (PM=A), all of the buffered unicast messages are forwarded to the normal transmit queue. When a station that was in active mode sends a message to the access point indicating that it is now asleep, (PM=PS), all messages in the normal transmit queue are moved to that stations unicast sleep queue.
The diagram below shows a block diagram of two power management schemes, both the ‘standard’ 802.11 scheme, and an ‘enhanced’ scheme developed for the WaveLAN.
Figure 16 Second power management diagram
The end node stations, when not actually transmitting, switch between the DOZE and ‘listening for a beacon’ state. The station’s timer wakes the station up just prior to the beacon frame. If there are no messages buffered, the station immediately drops back into DOZE mode. This cycle, used in both the 802.11 ‘standard’ scheme, (shown in blue and light gray) and the WaveLAN ‘enhanced’ scheme, (shown in blue and dark gray) allows the station to spend up to 99% of its time in DOZE mode.
In the standard scheme, when buffered messages are detected, the station stays AWAKE, and either waits for multicast messages, or actively polls the access point for its messages. Once all messages are received, it then goes back to DOZE mode. The enhanced scheme adds a ‘holdover’ state that is used when a transmission is detected, or buffered messages are present. This holdover state temporarily switches the station from DOZE to ACTIVE mode, and sets (PM=A). The access point then transmits all buffered messages, and halts unicast queuing for that station. The station stays active until the holdover period, (usually .5 to 3 seconds) has passed with no transmit or receive activity occurring for that station. The advantages to this holdover state are due to the fact that most LAN activity is bursty. Bursty is, periods of no traffic followed by periods of heavy traffic. By keeping the station in the active state for the holdover period, the formation of queues is avoided. Also, the message polling system used to get buffered messages is rather inefficient. Finally, if the station has been asleep for awhile, it is handy to keep the station awake long enough for any applications on the station to tend to their own network-related housekeeping, and to receive any traffic related to that housekeeping. As an example of the differences in power usage, for the WaveLAN, the transmit mode draws 300mA, receive mode draws 250mA, and DOZE mode draws 9mA, so the power savings can be considerable.
Now that we have covered most of the 802.11 specification, let us look at some of the devices that actually use 802.11. The WaveLAN is viewed in more detail than the others, since there is more detail available. In general, most of the non-device specific features of the WaveLAN, will apply to all 802.11 devices.
The WaveLAN was introduced by NCR in 1991 for wireless networking. The WaveLAN was designed to operate in the 915MHz band, and was originally produced as an ISA (Industry Set Architecture) card for desktop PCs. During the product’s lifecycle, other cards were produced for other buses, and WaveLAN was upgraded to operate in the 2.4GHZ band. The WaveLAN was improved with regard to operating systems supported, card size, power consumption and software support. The heart of the card, namely the NCR digital signal processing (DSP) application specific integrated circuit (ASIC) and Intel Ethernet controller were not. The WaveLAN is not technically an 802.11 device, as it preceded the standard, but many of its features were used by the 802.11 committee.
The current version of the WaveLAN has made considerable improvements on the base 802.11 standard, while retaining full compatibility. It allows for bit rates in the 10-11Mbps range, while being able to decrease its speed, or ‘fall back’ when communicating with a different 802.11 device that can only run at 1 or 2Mbps. This is because the training preamble/header of the transmission, looks the same regardless of bit rate. The preamble takes 200µsec to send/receive, and is modulated at a bit rate of 1Mbps. The data portion of the transmission, which can take longer to process, (maximum data size is 2.3KB/frame), can be sent different speeds, up to the maximum speed of the device. Both devices can negotiate the proper speed because the preamble is recognizable by any device that is 802.11-compliant. (This is a more complicated version of the way two modems handshake with each other to determine the best communications speed.)
In standard DSSS, the 11-chip Barker code is used to carry 1 or 2 bits of data per pulse. This gives us the standard 1 or 2Mbps speeds on standard 802.11 devices. This signal, or lobe is one chip wide, with the 10 additional chip positions in the symbol period creating sidelobes that are 11 times smaller than the main lobe. (Note: In any RF transmission, the main signal is the main lobe. Other, weaker versions of that lobe transmitted, are called sidelobes. This is noticeable when you drive by a radio station transmitter, and hear a station interfering with other stations that operate close to that station’s frequency. The interference is caused by, among other things, the sidelobes of the signal, which are normally to weak to be picked up. Sidelobes are also used to help jam radar.) Each of the other chips in the Barker sequence can also be modulated, in addition to the normal QPSK modulation. Lucent discovered a way to use this additional modulation to increase the number of bits per symbol from 1 or 2 to 10 or 11, which is being used in the 802.11 to enhance the existing throughput rates. This gives us, (and the AirPort), Ethernet speeds without wires. There are some downsides to this, namely that with higher performance, signal-to-noise, s/n, ratios become more of a concern, with the higher speed transmissions requiring s/n’s of 6dB.
The WaveLAN card has a number of physical traits, which are common to all 802.11 PCMCIA card devices, so we will use it as an example for other 802.11 devices. Note: The diagrams and chipset names were as of late 1997, so some details may have changed, but the basic structure is the same today.
Figure 17 WaveLAN block diagram
The first section is the antenna, used for transmitting and receiving. The card uses 2 L-shaped inverted-F antennas. These antennae are spaced between .25 and .5 of a wavelength apart, which gives good separation. The antennae act as a “leaky” 2.45GHZ resonator, +/- 100MHz, which aids in the function of the antenna. Plus, the shape of the antennae ensures that it is no bigger, overall, than .125 of a wavelength, which helps to make it very omnidirectional. This characteristic allows the WaveLAN to avoid the need for a line-of-site requirement in its operation. (NOTE: Antenna are cut/sized to specific multiples of the wavelength of the signals it transmits or receives. By using even multiples or fractions of the wavelength, the antenna can be made much smaller than the full wavelength, which, in the case of shortwave, low frequency signals, can be hundreds of meters. Wavelength and frequency are inversely related, with the wavelength going down in size as the frequency becomes higher.) The next section is the RF front-end. This performs up/down conversions of outgoing/incoming signals based on a 352MHz intermediate frequency (IF). This section also includes a low-noise amplifier. Side Noteà(NOTE: Up/down conversion is done to save space and components. At higher frequencies, if you want one unit to operate across multiple frequencies, which receives signals from the low MHz range into the 30+ GHz range, you must either use multiple antenna and RF sections, one per frequency, OR, you use a wider range antenna and a mixer, set at a known intermediate frequency, such as the 11GHz IF in radar detectors. This mixer separates the incoming signals from the 11GHz IF, and allows signal discrimination and analysis to be handled behind the antenna, saving space and weight. This mixer approach also uses less power than the multiple antenna/RF section method.)
Behind the RF front-end is the IF transceiver. This section handles IF-baseband up/down conversions via a (de)modulator chip derived from a Global Systems for Mobile Communications, (GSM) chip. Following along the component chain, we next have the DSP ASIC, named Theseus. This chip handles the analog/digital and vice-versa conversions between symbol streams and RF signals. This DSP is required because the speeds at which the WaveLAN runs require about 2000 multiply-add operations/µsec, which is too much for standard DSP chips. This chip is the main engine of the WaveLAN card, and has 2 digital to analog converters and 2 analog to digital converters, all of which run at 22MHz with a 6-bit digital representation.
The final ASIC in this line is the Wireless MAC (WMAC), protocol ASIC, called Hermes. This chip handles the 802.11 frame transmit and receive functions, as well as power management, Automatic Rate Fallback (ARF), Multi-channel roaming and handover management. The other two hardware components are the flash ROM and the RAM chips, which handle configuration information and message buffers respectively.
Finally, the WaveLAN is a scalable system, which can contain as many, or as few, access points and their cells as is needed. The power level of the WaveLAN transmitter is 15dBm, or 30mW. As a station communicates with an end node, the signal levels increase and decrease as the station moves closer to, or further from, the access point. Each access point has a configurable carrier detect threshold (CDT). Each access point usually employs 2 levels of CDT in an inner / outer cell configuration. Within the smaller inner cell, the CDT is higher, and faster communication rates, up to 11Mbps can occur. The larger outer cell has a lower CDT, and communication speeds are limited to 2 or 1 Mbps. If the signal level falls below the outer cell’s CDT, the station cannot communicate with that access point, and must either connect to another point, or network communication is interrupted. By configuring the CDT levels, more access points can be located closer together, and share the same channels. Sharing is assisted by another configurable threshold, the defer threshold (DT). The DT is lower than the CDT, as its purpose is different. When an access point detects a signal above the DT level, the station holds up a pending transmission. This behavior is called deferral. Within the deferral radius, which coincides with the inner cell, all stations defer to each other as part of the 802.11 CSMA/CA rules and behaviors. Outside of the deferral radius, in the outer cell, deferral is not guaranteed, so the RTS/CTS rules are used to avoid collisions. The total cell area is called the Basic Coverage Area, or BCA. The part of the cell with guaranteed coverage is called the Shared Coverage Area, or SCA. Ideally, we want the SCA and BCA to be identical. The sizing of the SCA and BCA are important in a multiple access point/cell network. If many cells are used, then the SCA and BCA areas can be equal, as the access points are close enough together to allow handover to happen more often, keeping the station in the higher-speed SCA areas at all times. If for any reason fewer cells are available, then the BCA is larger than the SCA, and only the areas outside the SCA in the cells overlap. This is a benefit, as fewer access points are needed, but can be a hindrance, as connection speeds rise and fall as a station roams throughout the network. To allow smooth transition between the high and low-speed areas of the cell or cells, an automatic rate fallback, or ARF, is used. The ARF allows the WaveLAN to decrease its speed as it moves farther from the access point. The station to remains connected for greater distances instead of only allowing the highest speeds. In addition, the ARF allows the stations and access points to communicate if the signal quality degrades for some reason, allowing for reliable communication in more adverse conditions. The ARF is relatively simple in function. It keeps track of the ratio of successfully transmitted frames to unsuccessful transmissions. As the number of unsuccessful transmissions increases, it slows down the bit rate until the ratio is at proper levels. When the ratio improves, it increases the bit rate back to the normal maximum.
The second 802.11 product found was SkyLINE by Farallon. Similar to the WaveLAN, SkyLINE is a DSSS device that operates in the 2.4GHz spectrum, allows for easy wireless networking by a variety of devices. However, even though both are 802.11-compliant, there are some important differences. SkyLINE operates on a more standard 802.11 scheme, with top speeds limited to 2Mbps, which gives the SkyLINE a stated range of up to 1000ft outside, and 300ft indoors.
The SkyLINE is based on the Harris PRISM chip set, and comes with software for both the MacOS and Windows. The user can set various configurations for connecting to access points, or other end nodes in an ad-hoc setup.
Figure 18 Skyline Control Panel
As you can see in Figure 19, the software controls the modes of access and addressing, as well as keeping track of the signal strength of the current connection. Although not an interesting statistic, the strength meter does give you the ability to tell if you are attempting to connect to an access point that has a good enough signal to maintain a reliable connection.
The SkyLINE card is a standard PCMCIA card. The antenna and status lights protrude from the end of the laptop, when the card is inserted. There have been some complaints when comparing the AirPort card in the iBook to systems such as the SkyLINE regarding the protruding antenna in non-AirPort devices. The reason for this is simple. In the iBook, and the high-end G4s, the antenna is built into the case, so the card can be completely internal to the computer. With other computers, the antenna is not a part of the structure, but is part of the 802.11 card, hence, the protruding antenna, as seen below.
Figure 19 SkyLine card
The antenna is an internal dipole, similar to the WaveLAN, (One thing that you will notice about products that have similar requirements, is that the construction does not tend to be terribly different.) Transmit and receive power levels are also similar to the WaveLAN, (2.4w Transmitted, and 1.6w Received.) The SkyLINE also follows similar power saving methods, as most of these are dictated by the 802.11 standard, and the requirements of a PCMCIA card. Farallon has stated that tests show the SkyLINE to be operable with the AirPort and other 802.11 devices, such as the WaveLAN. The SkyLINE and AirPort cards can easily connect to an AirPort pod.
The Skyline operates on 14 channels within the 2.4Ghz band, and uses the channels in a number of ways. When connecting to an access point, it goes through the channels until it finds a point with enough signal strength for a reliable connection. By splitting the band into channels, the SkyLINE can avoid problems with end nodes and access points interfering with each other. Also, it uses the channels to search for an access point if the one its currently connected to should fail, or loose strength. This is similar to the WaveLAN’s methodology for roaming and reacquisition after signal loss. Finally, if a laptop or other portable with a SkyLINE card is put to sleep, upon awakening, the SkyLINE card automatically attempts to reconnect to the network.
The final 802.11 device in our examination is Apple Computer’s AirPort. The AirPort consists of 2 parts: The end node device, such as the AirPort cards in the iBook and G4, and AirPort Base Station, or Pod. One of the obvious differences between the AirPort card and other 802.11 end node devices is the lack of an antenna. Apple has built the antenna into the case of the iBook, and the high-end G4s. By doing this, Apple is able to make the AirPort card completely internal, so as not to mar the lines of their newest computers. It reduces the cost of the card, because the antenna cost is a part of the computer cost, and not the AirPort cost. This design also allows more room, so they can use a bigger antenna which gets better reception from a weaker signal than the .125 wavelength antenna used in devices such as the WaveLAN.
Apple has announced two access points as well. The first model is the Pod, shown at the MacWorld Expo ’99 in New York, supports ten users, with a range of 150 feet. The Pod has two wired inputs, one 56K modem port, and one 10/100Mbps Ethernet port. Simple math gives the reason for Apple stating a 10-user limit on the Pod: With a maximum bandwidth of 100Mbps, 10 users is the max that could get the 11Mbps advertised speed from their AirPort cards. In reality, you can connect more users to a Pod, but the bandwidth drops in proportion to the number connected. The range numbers reflect this as well. 150 feet is the maximum reliable range for an 11Mbps connection. As you go farther from the Pod, your speed drops until you either disconnect, or connect to a new Pod. In addition, the wired connection is an either / or proposition. You can’t have both running simultaneously. Concurrent connections would require the Pod to act as a router, and driven the cost up along with that functionality. Finally, the 10-user pod does not support roaming. Considering the target market for this model, this is not surprising. Most home and K-12 educational users don’t need roaming, as one pod can easily cover most homes completely. In a K-12 setting, the students are disconnected between classes, so roaming is not an issue there either. Also, by eliminating the roaming feature, Apple was able to keep the Pod cost down to the $300 range. Apple recently announced a 40-50 user Base Station that does support roaming, but no details have been released as yet.
At present, there are only about two well-known competitors to 802.11 in the wireless networking world. (I know I am leaving out a host of vertical market systems, but I am limiting this to non-proprietary systems, so as to compare similar systems.)
The first and better-known system is IrDA, or InfraRed Data Association. While IrDA is best known as a laptop to printer connection, the IrLAN specification does allow for a wireless infrared LAN. IrLAN is designed to run at speeds of up to 4Mbps, and is a fairly cheap hardware specification. Even with good speed, and cheap hardware, IR in general has limitations that make it unsuitable for general-purpose networks. One of the problems is that walls, people, or sources of heat, such as the Sun, stop IR. So right away, IrLAN is pretty much indoor only. Also, since IR cannot go through walls, to use it in an office situation, the only way to avoid having everything be in a direct line of site, the IR signal must be reflected somehow. This involves ensuring the ceilings, and sometimes the walls of a building are made of an IR-reflective material. Reflective materials are expensive and aesthetically unappealing, as it rather limits wall treatments and paint colors. Finally, the range on IR tends to peter out at about 10 meters, so the number of APs required to cover a given area is larger than for 802.11. This is not to say that IrLAN is not useful. In a warehouse situation, or an assembly situation, it can be a cheap alternative to wiring computers together. Also, since virtually every shipping laptop has an IR port, in a college lab situation, it is an easy way to allow students to print with their own laptops, as opposed to using email or a sneakernet to get the files to a computer on the school network. In specialized situation, IrDA can be useful, but speed, range and other limitations relegate it to a niche networking technology.
The other currently popular standard is Bluetooth. Sponsored by a computer and telephony consortium of companies such as IBM, Nokia, Intel, and Ericcson. Bluetooth has been getting a lot of press lately as a new networking standard. Bluetooth operates in the same ISM band as 802.11, but it is designed around a much smaller scale than 802.11. Bluetooth is designed to give vendors of cell phones, PDAs, handheld computers, etc, a way to create piconets and connect these devices easily. Bluetooth has a range of 10 meters normally; 100 meters with amplifying repeaters. The maximum data rate is 1Mbps, although 720Kbps is normal. Due to these range and speed limits, obviously Bluetooth is not a true competitor for 802.11, or Ethernet. So what space does Bluetooth occupy? Interestingly enough, Bluetooth seems to be more of a RF competitor to IrDA. Its a low-cost way to create wireless connections between devices that don’t have high data or range requirements, such as keyboards, joysticks, cellular modems, etc. An example is a wireless joystick used to play a flight simulator that is using an 802.11 connection to share a cable modem or DSL line. Another valid comparison would be USB vs. FireWire, with Bluetooth filling the USB role. Bluetooth is very attractive to cell phone manufacturers and PDA vendors, as those devices take on more of each other’s features. Since Bluetooth is an RF specification, it carries all the advantages of RF, such as omnidirectional broadcasting. . Another example is two Bluetooth-enabled PDAs communicating without being pointed at each other as IR ports require. Bluetooth can also enable short-range cell phone communications without having to place a traditional phone call. You can look at the list of Bluetooth phones in range, and talk to one, just like a set of walkie-talkies. Another use could be easier printing from PDAs, cell phones, or even Bluetooth-enabled pagers. In conclusion, Bluetooth looks to be a good, smaller companion to 802.11, instead of a competitor.
Both the AirPort and the 802.11 specification are poised to make an enormous impact on the computer world. Apple is leading the way to increased usefulness of networks, and the number of networked computers overall by introducing a high-speed, easy to use, inexpensive, standardized wireless networking system,. Especially in the home market, where many users are reluctant to run wires, or buy hubs, etc., the ability to wire your home in a few steps, at a more than reasonable price should create an marked upswing in the number of networked homes. In addition, by ensuring that the AirPort is an 802.11-compliant system, Apple avoids proprietary hardware problems, and which makes them an attractive vendor for corporate wireless solutions. Also, the publicity generated by the iBook and the AirPort system will create a swell of demand for these systems, resulting in sales for all 802.11 vendors. Increased sales help promote the 802.11 standard itself, and drive upgrades to the speed and capability of the standard at a faster rate.
Bibliography and References
Kamerman, Ad and Leo Monteban. “WaveLAN-II®: A High Performance Wireless LAN For The Unlicensed Band”. Bell Labs Technical journal (Summer 1997), pp. 118–133. Lucent Technologies.
Stallings, William. “Local and Metropolitan Area Networks” Fifth Edition Prentice-Hall Inc., 1997.
Hayes, Vic, and Vesuna Sarosh. “Wireless LAN Standard” PowerPoint presentation, Lucent Technologies.
April 2, 2005
On “Leadership Opportunities”
There are, when one is in charge, these moments that I call
Leadership Opportunities. They are moments when a person has a chance to change a situation for good or ill, without needing huge programs or policies. They can be simple things, like remembering that someone just had a death in the family, and instead of sending an email, or having your assistant send flowers with your name on them, dropping by their desk, taking them to lunch, and letting them know that as much as possible, the company will do what they can to make a bad situation a little easier. They can be complex things, like having a suggestion program mean something.
But they happen a dozen times a day, and if you ignore them for too long, you'll have a company full of people that only work there for the money, and the benefits, and will leave you the first chance they get.
I see the consequences of flubbing Leadership Opportunities every day. I also see the rewards that happen when you handle them correctly. When continuously flubbed, moral dives, and people do their jobs just well enough to not get fired. When handled correctly, you get a cadre of people who will kill themselves for you, because they know you respect them.
That is, by the way, what Leadership Opportunities get you. Loyalty borne of mutual respect. By properly handling an Leadership Opportunity, you show that you respect your employees as people with skills and abilities that you don't have. You show them that you understand that they are just as critical to the success of the company as you are, perhaps more so. The person at the top sets the tone and demeanor for the company. But they don't do the work. If you're in charge of a company, don't fool yourself. You may work long hours, but you need those people who call you boss far more than they need you. Without you, they're just unemployed. If they're good, they won't stay that way for long. Without them, you don't have a company, and if you've failed miserably enough at handling Leadership Opportunities, everyone who might employ you as an executive will know that you can't handle leadership, and you'll find that for some reason, you just can't seem to find a new gig as nice as your last one. Trust me here, people talk. Nothing you do is a secret.
The problem is, how do you know you're in the middle of an Leadership Opportunity? Well, it's not like you get a sign from the heavens. But if you assume that every contact you make with a subordinate is an Leadership Opportunity, you're on the right path. Let me give you some examples of Leadership Opportunities handled both right and wrong.
I've a friend who's a tech type for an audio company. One of the things they do is set up sound systems for events. Monitors, amps, speakers, the whole bit. Hundreds of thousands of dollars of stuff that all has to be shipped back and forth. The procedure for packing this stuff is meticulous, and there's no room for free-wheeling it, with good reason. Pack a box wrong, you just burned thousands of dollars. He told me of a new guy who thought he had a better way. Turned out he was wrong. About fifty thousand dollars wrong. As expected, he got called into the boss's office. The conversation went something like this:
You know why you're here, right?
You know what you did wrong?
Do you know exactly where and why you went wrong?
So you learned why we do things the way we do them?
Good, now get out of my office and get back to work.
Um....aren't I fired?
Fired? Hell no, I just spent fifty grand to train you, now get the hell back to what I pay you for!
Had the boss fired the guy, no one would have blamed him. But by properly handling that Leadership Opportunity, he not only showed everyone there that he respected them even when they screwed up, but he now had an employee that would just about die for him. All he did was not fire him, and make sure that he had learned from his mistake, and he had someone who wouldn't leave him for a mere raise.
You literally cannot buy that. You only get it from handling Leadership Opportunities right.
Friend of mine wakes up and sees that it's snowing like heck outside. Can't even see the ground from the third floor, where he lives. He said that he realized that driving was dangerous, and even being on the road was a bad idea. Since he's a sysadmin, and didn't have anything critical scheduled that required him to be in that day, he emailed his boss, and let him know that he was going to work from home over the VPN. The next day, he gets yelled at. Evidently, unbeknownst to him, the corporate tradition was that not only did you show up during a blizzard, but that the CEO would personally check every desk, and anyone not there had to use a vacation day.
Was this a justifiable position to take? Of course. You get paid to be at work, not home. However, thanks to this flubbed Leadership Opportunity, he now knows that his company only cares about him as a body filling a slot. His presence as a keister in a chair was more important than his health, well-being, and safety. As he said, “I don't think they're going to like my reaction the next United Way drive, or any other time they want a little more out of me, 'cause I'm done doing anything beyond enough to not get fired.” This is a guy who normally will spend a lot of his off-time thinking about ways to make things work better at work. Now, he shows up, does what he's required to, and leaves. If he's there late, it's because he has to be.
A flubbed Leadership Opportunity, and a potential star performer is now a warm body in a seat, gradually increasing his perusal of dice.com and monster.com. Even worse, there's no chance that anyone he knows will ever work for his company, in fact, he's probably warning them if they mention it. A flubbed Leadership Opportunity hurts you in so many ways.
Another company, another story. A guy has a new employee review to do. He's been keeping notes of the reviewee's successes and failures. He's noted that while she's not been perfect, any failures have been one time problems and for different reasons. Each time she's failed, she's had a good attitude towards it, and worked a little harder to make sure that she understood why she failed, and more importantly, doesn't repeat the mistake. Finally, the total number of failures even worth noting, are two. With two unrelated exceptions, she's been the kind of person that you want your company to be packed with. Good attitude, good work ethic, excellent quality, and every comment you've ever gotten has been positive. That review writes itself, and it did.
About a week after the review is turned in, he's told that he has to change it by a VP. He has to severely downgrade her rating because of one of the notable failures. Of course, like most failures, it didn't happen in a vacuum, and several people, including this VP contributed mightily towards it. He tells the VP he won't downgrade her. She earned that review. He's not going to downgrade it for a one time occurrence. To do that would send the message that dozens of successes, some quite critical were meaningless because she was imperfect one time. He doesn't want her to go, and that message would be a great way to do it.
So he stands his ground. Says he's not changing the review. The VP threatens to rewrite it to suit his needs. My friend tells him that if that review is rewritten, he won't sign it, nor will he have anything to do with it. Much discussion happens with the friend's boss, and he stands his ground. Luckily, the boss supports him with the VP. The VP tells him, “Well, she's only going to get the same raise as she would for a mediocre review, so it's not like you're doing her a favor there.” My friend replies, “That's not a problem, she knows times are tight. But with someone like her, telling her 'Thanks' for doing a good job goes a lot farther than you think, and even with a mediocre raise, she'll continue to bust her hump if she knows that her work is appreciated. That's what that review is for.” She gets the great review and the mediocre raise. Comes to my friend a month later and says that she just found out what he went through for her, and wanted to thank him. He told her, “I didn't give you that review, you gave yourself that review. If you want the next one to be that good, it's going to be a lot harder, because that review now spells out what I'll consider to be 'average' performance for this coming year.” He said she looked at him for a long time, realized he was serious, and took him up on that challenge. He says her next review was only hard to write because he kept running out of synonyms for “outstanding”.
There we have two simultaneous Leadership Opportunities one handled well, one handled poorly. My friend handled his well, and got an employee who knew that she could trust him to have her back, and stick his neck out for her, so that she could do her job well, which made her more than willing to prove to him that he could expect to keep writing those excellent reviews. My friend learned that the VP of his department was an amoral jerk who would trash someone so that he could feel good about giving them a bad raise. Neither my friend nor his reviewee work for that company anymore, and both were glad to leave.
Another friend of mine works for a company where the leadership is only encountered at company meetings, or random hallway encounters. Any other encounter only happens when the stuff has hit the fan, and bad things are about to happen. Rumors are rampant, secrecy is the word of the day, and working with people outside of his department happens in spite of the company's best efforts. Even working with people in his own department is nigh-impossible. He still doesn't know what most of the folks in his department even do or look like. His environment is a string of almost constantly flubbed Leadership Opportunities, because the folks at the top are using the best leadership traditions of Louis the XVI and Marie Antoinette. Since they don't encourage communication, no one does, and the string of flubbed Leadership Opportunities piles up like garbage during a strike.
Leadership Opportunities are hard, they don't warn you, and you only get one chance to handle one right. However, learning to recognize them, and handling them correctly are critical to the success of your company.
I challenge anyone in a position of power reading this to review their last three incidents that could have been an Leadership Opportunity and look at it from the other person's point of view. Did they walk away feeling good, bad, or apathetic? Did you show them the respect you want from them, or did you show them that you only care about their output? Did you ace it, or flub it. Eventually, you'll know. You always do.| Comments ()