Steve Bellovin

I'm an affiliate scholar at Georgetown's Institute for Technology Law and Policy, and a computer science professor emeritus and former affiliate law prof at Columbia University. Author of "Thinking Security". Dinosaur photographer. Not ashamed to say that I’m still masking, because long Covid terrifies me.

Home Page: https://www.cs.columbia.edu/~smb/
Pronouns: He/Him
Photography-only account: Urban Dinosaurs (npub1q4m…njgq)
License: All of my photos available via a Creative Commons BY-NC license: http://creativecommons.org/licenses/by-nc/4.0/

Last Notes

2025-08-18 14:18:07 UTC

I use Nikon gear, not Leica (way out of my price range—Nikon is bad enough, given the lens I need for bird photography), but this linked-to article, about Leica's efforts in the 1930s and 1940s to help protect Jews from Hitler, was fascinating: https://en.wikipedia.org/wiki/Leica_Freedom_Train
https://wandering.shop/@cstross/115048999830402514

2025-08-13 19:46:01 UTC

Looking back at the proceedings of Usenix '84, the first time I was on a program committee (https://archive.org/details/1984-proceedings-summer-salt-lake-city/page/n3/mode/2up). There were two program co-chairs and *four* PC members… This year, Usenix Security has >400 people on its PC. ( @npub1lq6…nf7e, I see that you were at that conference, too.)

2025-06-20 21:55:43 UTC

If you understand the functional purpose of this getup, you’re an old-timer like me who was willing to work around stupid restrictions. (Hint: often, the lever part of a nail clipper could achieve the same ultimate goal.)
Oh yes—that’s an RJ-11 phone jack, not an Ethernet port.
What’s it for!
https://media.infosec.exchange/infosec.exchange/media_attachments/files/114/717/919/724/416/771/original/aef98d5746bee7fb.jpeg

2025-05-07 13:11:26 UTC

- reply

So what is a RealID? In CS terms, it's a cache of information from so-called "breeder documents". If you don't have a cached item, bring the breeder documents instead…

2025-05-01 23:15:36 UTC

- reply

Sounds vaguely familiar, but if memory serves, that was the admin's userid. Of course, back then the password might have been the same, but back then you generally had an operator logged in full time.

2025-04-07 15:34:38 UTC

There's an interesting Guardian article on the Signal chat fiasco: https://www.theguardian.com/us-news/2025/apr/06/signal-group-chat-leak-how-it-happened (h/t @npub1gsa…q4wj). I won't try to summarize the article; read it yourself. But we have a combination of an AI failure (the phone decided that it was Hughes' phone number), a UI failure (the phone did not make it crystal clear whose contact information was being updated, a user error (Waltz didn't read the phone screen carefully enough because of the second error), a technology problem (there's no official secure text message system, a policy issue (picking Signal even though it lacks important features to secure such exchanges), etc. To quote myself, "complex systems fail in complex ways."

2025-03-31 15:57:56 UTC

- reply

Be strategic in your questions. They're *not* going to tell you what's going on, nor will they say if it's a traditional “spying for China" investigation. They may be willing to say if the situation is related to the current ICE nonsense. No idea if they'll explain why they memory-holed his web page, etc.

2025-03-21 19:41:47 UTC

- reply

I don't think EO numbers restart with each presidency. See, e.g., https://www.federalregister.gov/presidential-documents/executive-orders/joe-biden/2025 — but I wouldn't bet against Trump (or Musk…) wanting that number in particular for this order.

2025-03-03 15:43:54 UTC

- reply

Or the military threats to Greenland and Panama. Plus all of the millions who will die because of cuts to USAID, Medicaid (and maybe social security), public health in the US in general, and more.

2025-02-10 17:25:14 UTC

- reply

In some of my CS lectures, I've had to say things like “must avoid statistical bias—which isn't the same as, but can be related to, legal bias." In other words, I can't even teach straight CS without using forbidden words and concepts.

2025-01-31 17:08:51 UTC

Waiting for the Orange Chaos Monkey to ban smartphones because the original ARM chip they run on was co-designed by a trans woman, Sophie Wilson.

2025-01-29 14:14:11 UTC

- reply

Well, you know what this administration thinks of facts…

2025-01-28 20:59:29 UTC

- reply

Whether or not they would like to, I can't say, but at least for US users they're generally not allowed to give it to the government, by law and the Fourth Amendment. (Exception: the statute permits handing over email older than 180 days, but there's pretty strong agreement that that exception is unconstitutional.) They're not even allowed to hand over non-content data without a court order.

2025-01-08 18:53:27 UTC

Timeline cleanse
https://flipboard.com/@newyorktimes/home-page-91uottdbz/-/a-uoFdJB_SSiKb7su9eZdp2w%3Aa%3A3195393-%2F0

2024-12-21 23:15:57 UTC

A rant in two parts. This is part one…
The discussion earlier today about systemd replacing /var/log with some dedicated facility and a special command, journalctl, to query it impelled me to write up just what I think is wrong with a lot of Linux. Basically, they've given up on the Unix philosophy of small, composable, generally usable but simple tools in favor of a mass of large, specialized tools. "They've paved Paradise and put up a parking lot.”
Why specify a pager instead of just piping the output to a pager? Being able to search on a specific field is nice, but grep can do that. Maybe grep should be enhanced to say “apply the RE to fields m..n” (which is easy enough with awk anyway), and arguably it could take a file giving mappings of a fieldname to a field number. That's a generally useful tool; why limit it to systemd log files? Searching by time is nice, but it's nice in other contexts, e.g., the output of 'ls -l' on a large directory. The same goes for json-style output: why limit it to this context? (I won't even rant about why there has to be a single-line vs. multiline json option—that could also be a pair of simple, general commands.)
Too many Linux subsystems (or rather, their authors) have decided that they are the world and have to provide lots of functionality specific to that subsystem, rather than building general tools. Steve Jobs once said of Windows, “The only problem with Microsoft is that they just have no taste. They have absolutely no taste.” That's what's going on here.

2024-12-18 18:51:47 UTC

Staring at the TP-Link router about a meter away from me, and wondering what to replace it with…
https://mastodon.social/@arstechnica/113675247916569149

2024-12-12 13:52:23 UTC

Exploiting mansplaining as tradecraft during WW II:
“If she wants to know something specific, but doesn’t want people to notice her asking questions, she should simply make incorrect statements while in the company of experts. Her companions will correct her, especially if they're men.”
From Elyse Graham's “Book and Dagger”, describing a training school for the SOE.