In addition, back by popular demand because you asked for it… wishlist for my 30th. See you guys on Nov 2.

Stuff I like..

Stuff that’s crossed my mind recently…

A word about Money…

Money is a social necessity that becomes less and less of a priority as I age and develop my sense of what I find important in my life. I make very little, and generally do not have much left over after my modest monthly bills. One of my largest projects is a volunteer position as a founder of a non-profit, and often my performances are unpaid – I have chosen to do what fuels me, and have worked hard to reduce my financial footprint to where I can live how I want and not have to worry (too much) about making a lot of money or making my decisions based on that.

That said, money is a great gift for me. There are things I enjoy and/or would benefit greatly from that are difficult to acquire by means of trade or barter, and money is as versatile as my interests at the time. There is a stigma about money being a cop out gift, and in some respects I can see why. However, for me, money is great. I can use it to stroll the produce section and get my food for the day,  shoot myself into space, go see a movie with you, get some new paint colors, or pad the bank account for vita-arts.org. Neat stuff!

So if you’re stumped, strapped for time, across the country or whatever and a simple ‘happy birthday’ doesn’t float your boat, just send me a fatass check. I’ll totally dig it, and promise I will do something cool with it.

Here’s to making it ]]> I am turning 30. I am having a party. Are you confident I would not want to burn the house down upon your arrival, considering my guests collateral damage for wiping you off the planet? Then request an invitation from the facebook event to RSVP!

In addition, back by popular demand because you asked for it… wishlist for my 30th. See you guys on Nov 2.

Stuff I like..

• Lunches
• Massages
• Baths
• Tea (decaf or low caf)
• Travel
• Essential oils
• Art Supplies
• Music
• Gift Certificates
• Tall socks
• Lacy things
• Candles
• Blank greeting cards
• Handmade things
• Corsets
• Dark Chocolate

Stuff that’s crossed my mind recently…

• Donate to http://vita-arts.org
• I really need a pair of slippers.
• UPDATE: I have chosen my ‘warm climate’ destination – Thailand. I’d like to go there to teach English to children for two weeks. The Cost is $550, plus airfare (~$1200).
• Plan a crazy awesome party for me Monday Nov 2.
• Allow my cat to come and go as she pleases http://www.moorepet-petdoors.com/Ideal-LCF-Window-Inserts-s/165.htm
• Swan #40 from Scott Radke – I <3 that man and his awesome wife so much. http://www.scottradke.com/12swan40.html
• Save my music and digital art from being wiped out again http://www.nextag.com/1-tb-external-drive/search-html
• I should probably have performers insurance…  ($200 per year) http://www.specialtyinsuranceagency.com/performer-insurance.html
• Aziz, lights! http://www.cowboystudio.com/product/c07/p0701-14.php
• Would be awesome not to have to set my camera on a table or stack of books http://www.cowboystudio.com/product/c11/p11-09.php
• Magnetic 6-Jar Spice Rack, from bed bath and beyond
• Herbal Infusions http://www.teavana.com/Tea-Products/Tea-of-the-Month-Club/Tea-of-the-Month-Club-6-Month-Subscription.axd
• Awesome tins http://www.teavana.com/The-Teas/Tea-Gifts/Tea-Lovers-Tea-Gift-Collection.axd?cm_sp=Recos-_-ProductPage-_-EGS%20TE%20LOVERS%2009
• Like this store http://www.modcloth.com/store/ModCloth/Gift+Certificate
• Pleasink to be helping me pick up cat fur http://store.irobot.com/product/index.jsp?productId=3203440
• A real camera with interchangeable lenses http://www.usa.canon.com/consumer/controller?act=ModelInfoAct&fcategoryid=139&modelid=17499

A word about Money…

Money is a social necessity that becomes less and less of a priority as I age and develop my sense of what I find important in my life. I make very little, and generally do not have much left over after my modest monthly bills. One of my largest projects is a volunteer position as a founder of a non-profit, and often my performances are unpaid – I have chosen to do what fuels me, and have worked hard to reduce my financial footprint to where I can live how I want and not have to worry (too much) about making a lot of money or making my decisions based on that.

That said, money is a great gift for me. There are things I enjoy and/or would benefit greatly from that are difficult to acquire by means of trade or barter, and money is as versatile as my interests at the time. There is a stigma about money being a cop out gift, and in some respects I can see why. However, for me, money is great. I can use it to stroll the produce section and get my food for the day,  shoot myself into space, go see a movie with you, get some new paint colors, or pad the bank account for vita-arts.org. Neat stuff!

So if you’re stumped, strapped for time, across the country or whatever and a simple ‘happy birthday’ doesn’t float your boat, just send me a fatass check. I’ll totally dig it, and promise I will do something cool with it.

Here’s to making it this far!

I first went in 1995, when I was 15 and neck deep in linux, drugs and Marlboro Reds, and I’d recently discovered this thing called the web, and frequently picked fights about Slackware being superior to RedHat. I recall, during a recent move, finally throwing away my Slackware 2.7 CD which I had been keeping for posterity.

I went to defcon religiously for a time, my entire social network of people living inside a computer. I didn’t know most of their real names. I spent night after late night online tinkering, listening to music for the jilted generation (come to think of it, I think someone I talked to used ‘jilted’ as a handle..) and waiting for the next defcon, so I could see all these people in person again – and hardly remember most of it.

When I got a little older, I started playing with music, and joined mp3.com in 1997. The internet was still like the wild west and we were changing everything. My hacker friends helped me choose my juno 106 (thanks tfish) and hooked me up with equipment to make recording easier (tip of the hat to you whiteknight). After I created my first original song in 1999, on the floor of my living room, juno fresh out of its shipping box, paid for with my job breaking software at Microsoft, I started making a little money with CD sales and streams on mp3.com.

I was interviewed with ABCNews for an article on female hackers, and later about my music being online, based on a recommendation from Jeff Moss, assuring the reporter (Sascha, another person I’ve kept in touch with) I was definitely not a scene whore. I’m not sure how accurate that assurance was, but it sure felt good at the time. I still boast that Jeff pierced my navel, under mild duress in my studio apartment, sometime in 1999. That sounds pretty scene whorish to me, but who am I to say. Maybe we were just, you know.. friends.

Countless things have happened since my first defcon, and my introduction to the hacker community. My first website complete with a blue satin background and ripped off animated fire gifs was created in 1995, hosting a splattering of terrible teenage poetry. In 1997, Lars from the IRC channel #suicide sent me a black and white quickcam, and the neecam was put online, one of the first webcams during the era of Jennicam and Anacam, both of which were more popular, active and racy.

I’ve occasionally contemplated what my life would have been like had I never discovered the internet and been part of a revolution. I can’t fathom it. I can’t fathom how I could have possibly found another pool of socially awkward, skinny, pale, wide-eyed geniuses to have sloppy, dysfunctional teenage relationships with either. One of many reasons I am very thankful that my life turned out how it did.

I happened upon this awesome article about some of my friends. The L0pht is a fine example of what’s happened with this culture of misfits and criminals, but this is something that’s happened all over the landscape we built 10 years ago and long before that. I remember writing a rant about the difference between the hackers, my friends, and the script kids that were getting all the bad press, writing worms and breaking websites for attention. The hackers meant for what’s described in this article to happen from the beginning. They were out to change the world.

LOpht in Transition 04/01/2007 Michael Fitzgerald/CSO

http://www.csoonline.com/read/040107/fea_lopht.html

Brian Oblivion. Kingpin. Mudge. Space Rogue. Stefan von Neumann. Tan. Weld Pond. That’s how the hacker group called the L0pht appeared before the Senate Subcommittee on Government Cybersecurity on May 19, 1998. They said, among other things, that they could take down the Internet in 30 minutes. The senators listened closely and afterward praised them effusively.

It was a landmark moment for hackers, shunned, derided and loathed by the technology industry. And it was a landmark for the L0pht too. Though the group was already known for its vulnerability disclosures, for the Hacker News Network, for tools like the hash cracking tool L0phtCrack, now “everybody [in the hacking community] wanted to be the L0pht,” remembers Jeff Moss, founder of the Black Hat and Defcon security conferences.

Not bad for a group that got its start when someone’s wife said it was time to get his computers out of the bathtub.

The L0pht shaped the way disclosures are handled and helped force vendors like Microsoft to change the way they address software security flaws. There’s no question, either, that by raising the visibility of security problems, the group spurred companies to begin paying more attention to security. “You knew you’d better rattle your own doorknobs before the hackers did,” says John Pescatore, a longtime information security analyst at Gartner.

Some think, though, that visibility has hurt software security. “They were the Led Zeppelin of gray hat hacking,” says Marcus Ranum, who is credited with creating the first commercial firewall product and is now CSO at Tenable Network Security. “By releasing gray hat tools and techniques they were able to get a tremendous amount of attention. And they opened the floodgates for all the bottom feeders that followed them.”

Ironically, it was Ranum himself who helped give the L0pht credibility. As CEO of NFR, which made software to find intruders on corporate networks, Ranum used the L0pht’s vulnerability research to strengthen his product, and hired the L0pht both to do a code review and to write modules for his product, giving the group a legitimate corporate client to tout. He says he considers the L0pht members his friends and says they are “great guys.” But he thinks those who have followed them find vulnerabilities almost as a way to blackmail corporations. He blames the L0pht, saying, “They have changed the industry for the worse.”

Nothing in the L0pht’s emergence from Boston’s bulletin board community in 1992 suggested it would achieve any more notoriety than other hacker collectives of the day. Brian Oblivion, a hacker with strong interests in radio communications, founded the group. Oblivion declined to be interviewed for this article, saying via Space Rogue that he was too busy. Chris Wysopal, who joined the L0pht in late 1992 as Weld Pond (a handle chosen by pointing at random at a map of the Boston area, because the bulletin board The Works forbade members to use real names), says that Oblivion “had so many computers in the bathroom that his wife couldn’t use it anymore.” She gave the group space in the South End artist’s loft where she made hats. And for several years, the L0pht was just a place for Oblivion and his friends to hang out after work and store their growing collection of computing equipment.

Among those friends were Space Rogue and a teenage hacker and skateboarder named Joe Grand, who went by the handle Kingpin (named for the bolt that runs through the truck, or axle, of a skateboard).

Grand calls from the road. He’s often on the road, literally—he is a triathlete good enough to have a sponsor. He’s 31 now and runs his own San Diego design shop, Grand Idea Studio, which has designed RFID and GPS modules for Parallax, an in-game videocamera for Gamecaster, and his best design yet, a video game accessory that he has licensed but can’t talk about.

Grand, an electrical engineer, has also written two books on hardware hacking and is a technical adviser to Make magazine. If all goes well with a pilot he’s recently shot, this fall we’ll see him on an engineering show on the Discovery Channel. Yet he’s nostalgic about the L0pht.

“I’m having a really hard time with realizing that I’m twice as old as when I joined the L0pht,” he says. “We did so many great things—what can I do to top that?”

The L0pht originally built a network so they could play Doom against each other. But they got more serious in 1994 and 1995, shedding some members and adding others with specific technical skills that complemented the group. They moved to a larger space in Watertown, Mass.

Excepting Grand, who was still in high school, all of the L0pht held various day jobs, often working together at places like Comp­USA, Massachusetts General Hospital or BBN Technologies, the fabled research lab (Weld Pond, Brian Oblivion, Mudge and Silicosis all worked there at some point). They kept their identities hidden, in part to keep their day jobs. Everyone in the hacking community knew Dan Farmer had been fired from his job for releasing the Satan network analyzer. But the group wanted to turn the L0pht into a day job.

The charismatic, long-tressed Peiter “Mudge” Zatko had emerged as the group’s public face, if not its de facto leader. He developed, along with Wysopal, L0phtCrack, a tool that revealed weak passwords. Released in 1997, it’s still available on some websites today. “Back then, the companies would pretend [vulnerabilities] weren’t real,” says Bruce Schneier, the noted cryptographer and CTO of BT Counterpane. Schneier says the L0pht’s ability to build tools like L0phtCrack forced vendors to address security problems. “That’s the reason we have more secure software today. If it wasn’t for that, Microsoft would still be belittling, insulting and suing researchers,” he says.

By late 1998, the L0pht was actively trying to attract venture capital and turn itself into a real business—it had pushed out Stefan von Neumann and a couple of other short-lived members, and hired Christien Rioux (known as Dildog) and Paul Nash (known as Silicosis) to support L0phtCrack and do custom work for companies like NFR. The L0pht was not the first group of hackers to offer professional services or tools, but even in the giddy late 1990s, hackers still had an unsavory reputation. Finally, @stake, a security consulting firm, came to the group with $10 million in VC money and told the L0pht it could continue its research. The members voted to join it.

Even so, that merger, announced Jan. 10, 2000, marked the symbolic end of the L0pht. Over the next few years, its members were fired or drifted away, and @stake itself was gobbled up by Symantec in 2004. The only member of the L0pht still there is Nash. The transition was particularly difficult for Zatko, who spent six months on disability and left @stake after just two years.

Today, Zatko’s office at BBN is a rest area for sundry things. There’s a dead computer on a chair, and a working circa-1940s polygraph machine on a table. In a corner are two fishing rods and an antenna, part of an impromptu communications experiment. There’s a guitar signed by one-time porn stars Barbara Dare and Jamie Summers. A bound copy of the L0pht’s testimony in front of the Senate is on a shelf. On one wall hangs a picture of him with President Bill Clinton and Vinton Cerf, in which Zatko’s light brown hair is still rock-star length. It’s short now, parted in the middle. He has a goatee and wears glasses. He’s sore from a boxing workout the night before, a reminder that he’s in his late 30s.

Zatko says he can’t talk about what he does at BBN, other than to say it’s security-related and for some unmentionable three-lettered government agencies. He also says he returned to BBN, which employed him in the 1990s, before the L0pht was his job, in part because BBN told him there could be no publicity about the projects he was working on. “That was attractive as hell,” he says.

But Zatko can’t seem to stay out of the spotlight. He is the obvious model for “Soxster,” one of the main characters in former cyberczar Richard A. Clarke’s new novel, Breakpoint (the L0pht itself appears as “the Dugout”). And he acknowledges that he still “wants to make a dent in the universe,” the old motto of the L0pht.

After an hour of talking about the L0pht, Zatko suggests a tour of the older parts of the BBN laboratory in Cambridge, dating from when it was an acoustics consultancy. He shows off the silent room, the amplification room, the sonar tank, the place where it developed Boomerang—a technology being used in Iraq to help find snipers—and he talks about how much he likes the variety of the cool ideas BBN pursues.

“Originally, the L0pht was meant as a microcosm of here,” he says, with a wistful expression.

The spirit of the L0pht lives on most directly at Veracode, the security software company started by Wysopal and Rioux after they left Symantec in 2005. The company launched at the RSA Security Conference in February.

Wysopal post-L0pht helped codify responsible disclosure policies and establish the Organization of Internet Safety, and while starting Veracode he also managed to be lead author of The Art of Software Security Testing, published in December 2006.

Wysopal, at a rangy 6 foot 2 inches, was the tallest member of the L0pht and the oldest (he’s now 41). Rioux (whose handle Dildog was the original name Dilbert creator Scott Adams gave to Dogbert) was the shortest and youngest (now 29).

In early January, sitting in the conference room at Veracode, the two play Click-and-Clack about their time at the L0pht, and the purpose of Veracode, which in a real sense extends the L0pht’s mission: to make software more secure, in this case by offering a Web-based service that automatically checks software for security flaws, via a clever—and patented—technique for data flow modeling and modeling control flow analysis developed by Rioux.

Told of Ranum’s comments, Rioux makes a slight grimace. “The days are over when we should be flinging mud over the Internet about vulnerabilities,” he says.

Veracode has pulled in $19.5 million in capital from Polaris Venture Partners, Atlas Venture and .406 Ventures. While it has competitors, such as Coverity, Fortify and Ounce Labs, Veracode’s approach is “a cool spin” on existing security technology, according to Gartner’s Pescatore.

Both Wysopal and Rioux believe Veracode is ready to sharply reduce the world’s total number of software vulnerabilities.

The L0pht, then, are all now unquestionably legitimate, and their evolution serves as a metaphor for the security business, which is now mainstream. Companies like Microsoft and Oracle have developed methods to take care of vulnerabilities, and the L0pht deserves some credit for that turn of events. While the disclosure wars are again raging, thanks to bug-a-day campaigns and other ploys by the hackers of today, the L0pht’s overall impact on corporate security has been positive, say many, including Howard Schmidt, who knew the L0pht both in his role as a computer forensics investigator at the Air Force and as CSO at Microsoft.

Still, some vendors continue to try to shove security issues under the rug, and there is no question that more of the Internet is under attack today than ever before. So what of that?

Peter Neumann (no relation to the L0pht’s Stefan von Neumann) is 74 and still a principal scientist at SRI, working on security issues. He also testified before the Senate subcommittee on that day in May 1998. He says security vulnerabilities are a part of a much bigger set of problems that have existed for 40 years and probably will exist 40 years from now. But he chuckles when asked about the L0pht, saying, “They were pointing out that the emperor has no clothes on, and nobody wants to hear that, but they did it in a tasteful way that made people listen. They made a difference.”

I’m so very proud of my friends, and feel fortunate today to have had these people in my life as examples. Hell, just today I discovered a hacker friend of mine, Josh Klein (who I met after handles weren’t quite so important to ones safety, so I don’t know his) was not only the speaker in a TED talk, some of the most amazing presentations on the planet, but was in Oprah fucking magazine talking about his passions and experiments. My peeps are DOING something.

I, too, am out there doing my part to make a dent in the universe. I support a company I believe in as I make my base living to earn the stable springboard life situation I’ve built to do my more risky work. I’ve found a way to channel my compulsion to express and tell vivid stories, and the skills I’ve picked up along the way, toward a non-profit that matters. I have done some meaningful things, and I am growing, expanding, discovering new routes and possibilities nearly every day. I’ve come a long way from the girl who was found passed out under a van before defcon 6 had even started.

For a time, I wondered if my life choices, and the people I spent time with, were the reason I seemed so fucked up and constantly struggling. I wonder 15 years later, if they’re a part of the reason that, right now, ]]> I feel fortunate and full today. I am going to DEFCON this year. I just received my itinerary from whitetras and it’s official. I’m bringing someone important to me to show him vegas for the first time.

I first went in 1995, when I was 15 and neck deep in linux, drugs and Marlboro Reds, and I’d recently discovered this thing called the web, and frequently picked fights about Slackware being superior to RedHat. I recall, during a recent move, finally throwing away my Slackware 2.7 CD which I had been keeping for posterity.

I went to defcon religiously for a time, my entire social network of people living inside a computer. I didn’t know most of their real names. I spent night after late night online tinkering, listening to music for the jilted generation (come to think of it, I think someone I talked to used ‘jilted’ as a handle..) and waiting for the next defcon, so I could see all these people in person again – and hardly remember most of it.

When I got a little older, I started playing with music, and joined mp3.com in 1997. The internet was still like the wild west and we were changing everything. My hacker friends helped me choose my juno 106 (thanks tfish) and hooked me up with equipment to make recording easier (tip of the hat to you whiteknight). After I created my first original song in 1999, on the floor of my living room, juno fresh out of its shipping box, paid for with my job breaking software at Microsoft, I started making a little money with CD sales and streams on mp3.com.

I was interviewed with ABCNews for an article on female hackers, and later about my music being online, based on a recommendation from Jeff Moss, assuring the reporter (Sascha, another person I’ve kept in touch with) I was definitely not a scene whore. I’m not sure how accurate that assurance was, but it sure felt good at the time. I still boast that Jeff pierced my navel, under mild duress in my studio apartment, sometime in 1999. That sounds pretty scene whorish to me, but who am I to say. Maybe we were just, you know.. friends.

Countless things have happened since my first defcon, and my introduction to the hacker community. My first website complete with a blue satin background and ripped off animated fire gifs was created in 1995, hosting a splattering of terrible teenage poetry. In 1997, Lars from the IRC channel #suicide sent me a black and white quickcam, and the neecam was put online, one of the first webcams during the era of Jennicam and Anacam, both of which were more popular, active and racy.

I’ve occasionally contemplated what my life would have been like had I never discovered the internet and been part of a revolution. I can’t fathom it. I can’t fathom how I could have possibly found another pool of socially awkward, skinny, pale, wide-eyed geniuses to have sloppy, dysfunctional teenage relationships with either. One of many reasons I am very thankful that my life turned out how it did.

I happened upon this awesome article about some of my friends. The L0pht is a fine example of what’s happened with this culture of misfits and criminals, but this is something that’s happened all over the landscape we built 10 years ago and long before that. I remember writing a rant about the difference between the hackers, my friends, and the script kids that were getting all the bad press, writing worms and breaking websites for attention. The hackers meant for what’s described in this article to happen from the beginning. They were out to change the world.

LOpht in Transition
04/01/2007
Michael Fitzgerald/CSO

http://www.csoonline.com/read/040107/fea_lopht.html

Brian Oblivion. Kingpin. Mudge. Space Rogue. Stefan von Neumann. Tan. Weld Pond. That’s how the hacker group called the L0pht appeared before the Senate Subcommittee on Government Cybersecurity on May 19, 1998. They said, among other things, that they could take down the Internet in 30 minutes. The senators listened closely and afterward praised them effusively.

It was a landmark moment for hackers, shunned, derided and loathed by the technology industry. And it was a landmark for the L0pht too. Though the group was already known for its vulnerability disclosures, for the Hacker News Network, for tools like the hash cracking tool L0phtCrack, now “everybody [in the hacking community] wanted to be the L0pht,” remembers Jeff Moss, founder of the Black Hat and Defcon security conferences.

Not bad for a group that got its start when someone’s wife said it was time to get his computers out of the bathtub.

The L0pht shaped the way disclosures are handled and helped force vendors like Microsoft to change the way they address software security flaws. There’s no question, either, that by raising the visibility of security problems, the group spurred companies to begin paying more attention to security. “You knew you’d better rattle your own doorknobs before the hackers did,” says John Pescatore, a longtime information security analyst at Gartner.

Some think, though, that visibility has hurt software security. “They were the Led Zeppelin of gray hat hacking,” says Marcus Ranum, who is credited with creating the first commercial firewall product and is now CSO at Tenable Network Security. “By releasing gray hat tools and techniques they were able to get a tremendous amount of attention. And they opened the floodgates for all the bottom feeders that followed them.”

Ironically, it was Ranum himself who helped give the L0pht credibility. As CEO of NFR, which made software to find intruders on corporate networks, Ranum used the L0pht’s vulnerability research to strengthen his product, and hired the L0pht both to do a code review and to write modules for his product, giving the group a legitimate corporate client to tout. He says he considers the L0pht members his friends and says they are “great guys.” But he thinks those who have followed them find vulnerabilities almost as a way to blackmail corporations. He blames the L0pht, saying, “They have changed the industry for the worse.”

Nothing in the L0pht’s emergence from Boston’s bulletin board community in 1992 suggested it would achieve any more notoriety than other hacker collectives of the day. Brian Oblivion, a hacker with strong interests in radio communications, founded the group. Oblivion declined to be interviewed for this article, saying via Space Rogue that he was too busy. Chris Wysopal, who joined the L0pht in late 1992 as Weld Pond (a handle chosen by pointing at random at a map of the Boston area, because the bulletin board The Works forbade members to use real names), says that Oblivion “had so many computers in the bathroom that his wife couldn’t use it anymore.” She gave the group space in the South End artist’s loft where she made hats. And for several years, the L0pht was just a place for Oblivion and his friends to hang out after work and store their growing collection of computing equipment.

Among those friends were Space Rogue and a teenage hacker and skateboarder named Joe Grand, who went by the handle Kingpin (named for the bolt that runs through the truck, or axle, of a skateboard).

Grand calls from the road. He’s often on the road, literally—he is a triathlete good enough to have a sponsor. He’s 31 now and runs his own San Diego design shop, Grand Idea Studio, which has designed RFID and GPS modules for Parallax, an in-game videocamera for Gamecaster, and his best design yet, a video game accessory that he has licensed but can’t talk about.

Grand, an electrical engineer, has also written two books on hardware hacking and is a technical adviser to Make magazine. If all goes well with a pilot he’s recently shot, this fall we’ll see him on an engineering show on the Discovery Channel. Yet he’s nostalgic about the L0pht.

“I’m having a really hard time with realizing that I’m twice as old as when I joined the L0pht,” he says. “We did so many great things—what can I do to top that?”

The L0pht originally built a network so they could play Doom against each other. But they got more serious in 1994 and 1995, shedding some members and adding others with specific technical skills that complemented the group. They moved to a larger space in Watertown, Mass.

Excepting Grand, who was still in high school, all of the L0pht held various day jobs, often working together at places like Comp­USA, Massachusetts General Hospital or BBN Technologies, the fabled research lab (Weld Pond, Brian Oblivion, Mudge and Silicosis all worked there at some point). They kept their identities hidden, in part to keep their day jobs. Everyone in the hacking community knew Dan Farmer had been fired from his job for releasing the Satan network analyzer. But the group wanted to turn the L0pht into a day job.

The charismatic, long-tressed Peiter “Mudge” Zatko had emerged as the group’s public face, if not its de facto leader. He developed, along with Wysopal, L0phtCrack, a tool that revealed weak passwords. Released in 1997, it’s still available on some websites today. “Back then, the companies would pretend [vulnerabilities] weren’t real,” says Bruce Schneier, the noted cryptographer and CTO of BT Counterpane. Schneier says the L0pht’s ability to build tools like L0phtCrack forced vendors to address security problems. “That’s the reason we have more secure software today. If it wasn’t for that, Microsoft would still be belittling, insulting and suing researchers,” he says.

By late 1998, the L0pht was actively trying to attract venture capital and turn itself into a real business—it had pushed out Stefan von Neumann and a couple of other short-lived members, and hired Christien Rioux (known as Dildog) and Paul Nash (known as Silicosis) to support L0phtCrack and do custom work for companies like NFR. The L0pht was not the first group of hackers to offer professional services or tools, but even in the giddy late 1990s, hackers still had an unsavory reputation. Finally, @stake, a security consulting firm, came to the group with $10 million in VC money and told the L0pht it could continue its research. The members voted to join it.

Even so, that merger, announced Jan. 10, 2000, marked the symbolic end of the L0pht. Over the next few years, its members were fired or drifted away, and @stake itself was gobbled up by Symantec in 2004. The only member of the L0pht still there is Nash. The transition was particularly difficult for Zatko, who spent six months on disability and left @stake after just two years.

Today, Zatko’s office at BBN is a rest area for sundry things. There’s a dead computer on a chair, and a working circa-1940s polygraph machine on a table. In a corner are two fishing rods and an antenna, part of an impromptu communications experiment. There’s a guitar signed by one-time porn stars Barbara Dare and Jamie Summers. A bound copy of the L0pht’s testimony in front of the Senate is on a shelf. On one wall hangs a picture of him with President Bill Clinton and Vinton Cerf, in which Zatko’s light brown hair is still rock-star length. It’s short now, parted in the middle. He has a goatee and wears glasses. He’s sore from a boxing workout the night before, a reminder that he’s in his late 30s.

Zatko says he can’t talk about what he does at BBN, other than to say it’s security-related and for some unmentionable three-lettered government agencies. He also says he returned to BBN, which employed him in the 1990s, before the L0pht was his job, in part because BBN told him there could be no publicity about the projects he was working on. “That was attractive as hell,” he says.

But Zatko can’t seem to stay out of the spotlight. He is the obvious model for “Soxster,” one of the main characters in former cyberczar Richard A. Clarke’s new novel, Breakpoint (the L0pht itself appears as “the Dugout”). And he acknowledges that he still “wants to make a dent in the universe,” the old motto of the L0pht.

After an hour of talking about the L0pht, Zatko suggests a tour of the older parts of the BBN laboratory in Cambridge, dating from when it was an acoustics consultancy. He shows off the silent room, the amplification room, the sonar tank, the place where it developed Boomerang—a technology being used in Iraq to help find snipers—and he talks about how much he likes the variety of the cool ideas BBN pursues.

“Originally, the L0pht was meant as a microcosm of here,” he says, with a wistful expression.

The spirit of the L0pht lives on most directly at Veracode, the security software company started by Wysopal and Rioux after they left Symantec in 2005. The company launched at the RSA Security Conference in February.

Wysopal post-L0pht helped codify responsible disclosure policies and establish the Organization of Internet Safety, and while starting Veracode he also managed to be lead author of The Art of Software Security Testing, published in December 2006.

Wysopal, at a rangy 6 foot 2 inches, was the tallest member of the L0pht and the oldest (he’s now 41). Rioux (whose handle Dildog was the original name Dilbert creator Scott Adams gave to Dogbert) was the shortest and youngest (now 29).

In early January, sitting in the conference room at Veracode, the two play Click-and-Clack about their time at the L0pht, and the purpose of Veracode, which in a real sense extends the L0pht’s mission: to make software more secure, in this case by offering a Web-based service that automatically checks software for security flaws, via a clever—and patented—technique for data flow modeling and modeling control flow analysis developed by Rioux.

Told of Ranum’s comments, Rioux makes a slight grimace. “The days are over when we should be flinging mud over the Internet about vulnerabilities,” he says.

Veracode has pulled in $19.5 million in capital from Polaris Venture Partners, Atlas Venture and .406 Ventures. While it has competitors, such as Coverity, Fortify and Ounce Labs, Veracode’s approach is “a cool spin” on existing security technology, according to Gartner’s Pescatore.

Both Wysopal and Rioux believe Veracode is ready to sharply reduce the world’s total number of software vulnerabilities.

The L0pht, then, are all now unquestionably legitimate, and their evolution serves as a metaphor for the security business, which is now mainstream. Companies like Microsoft and Oracle have developed methods to take care of vulnerabilities, and the L0pht deserves some credit for that turn of events. While the disclosure wars are again raging, thanks to bug-a-day campaigns and other ploys by the hackers of today, the L0pht’s overall impact on corporate security has been positive, say many, including Howard Schmidt, who knew the L0pht both in his role as a computer forensics investigator at the Air Force and as CSO at Microsoft.

Still, some vendors continue to try to shove security issues under the rug, and there is no question that more of the Internet is under attack today than ever before. So what of that?

Peter Neumann (no relation to the L0pht’s Stefan von Neumann) is 74 and still a principal scientist at SRI, working on security issues. He also testified before the Senate subcommittee on that day in May 1998. He says security vulnerabilities are a part of a much bigger set of problems that have existed for 40 years and probably will exist 40 years from now. But he chuckles when asked about the L0pht, saying, “They were pointing out that the emperor has no clothes on, and nobody wants to hear that, but they did it in a tasteful way that made people listen. They made a difference.”

I’m so very proud of my friends, and feel fortunate today to have had these people in my life as examples. Hell, just today I discovered a hacker friend of mine, Josh Klein (who I met after handles weren’t quite so important to ones safety, so I don’t know his) was not only the speaker in a TED talk, some of the most amazing presentations on the planet, but was in Oprah fucking magazine talking about his passions and experiments. My peeps are DOING something.

I, too, am out there doing my part to make a dent in the universe. I support a company I believe in as I make my base living to earn the stable springboard life situation I’ve built to do my more risky work. I’ve found a way to channel my compulsion to express and tell vivid stories, and the skills I’ve picked up along the way, toward a non-profit that matters. I have done some meaningful things, and I am growing, expanding, discovering new routes and possibilities nearly every day. I’ve come a long way from the girl who was found passed out under a van before defcon 6 had even started.

For a time, I wondered if my life choices, and the people I spent time with, were the reason I seemed so fucked up and constantly struggling. I wonder 15 years later, if they’re a part of the reason that, right now, I’m not.

Recently, I became privy to a poetic, well-written and obviously heartfelt summation of a friends first experience at LRS. I feel very excited and privileged to share it with you, with permission by the author and our creative director.

REVIEW OF The Black Show at THE LITTLE RED STUDIO

The Little Red Studio is immersion theatre. I had no idea about this going in, and in fact, had thought, as I walked up to their seemingly unassuming red door just north of downtown, that I’d be seeing just what I’d been invited by theater coordinator Kerry Christensen to see: a show. You know, a show…a play. The kind where the same thing happens as has happened a hundred times before. You buy a ticket. You get program. You find your seat. The lights go out and something begins to happen on a stage. You watch whatever it is that happens. You leave. I had no idea how different this particular show was going to be.

When I walked up, the man at the door informed me that there was a reception around the corner and that I would be led back to the theatre once the space and the cast was ready. I remember one of my eyebrows going up as I looked at him, sort if in this quizzical Spock sort of way, as I thought “You mean I can’t just walk in and sit in the dark and prepare to watch something happen onstage?” Already this night was turning interesting.

I walked to the space around the corner and upon walking into what seemed to be the theater’s office space, I was asked by the first of many people that night who greeted me with a smile, to check in, which I did with two women who handed me a carnation, and offered me a glass of wine. They asked me to enjoy the string player who was filling the room with music, or to look at the art on the walls while I waited to be led to the space for the show.

The art, which I later realized were accurately painted images from the show I was about to see, were huge canvases, most definitely intriguing: nude bodies of various sizes and shapes in body paint, all with texture and feeling. This show was not going to be a tired rendition of Chekhov or Ibsen. I was getting really interested.

People milled around chatting, each carrying a flower like I was. The room felt somewhat like a cabaret, but with an edge. I could sense that I might end up being a participant in the evening…

We were here to see The Black Show, the Little Red Theatre’s second of three “color” shows, and this one in particular had caught my attention. It had been described to me as erotic, death-infused, and rich. These are themes which strike home with me, and having felt recently a need to connect with more passion in my life, and to explore my heart and mind in new adventurous ways, this sounded like a great show to go see.

Turns, out, it was a great show in which to particpate as well. What actually happens in the show? That is difficult to say. Every night is a little different. It all depends on what the participants bring to the the event in terms of their willingness and energy.

On this particular night, we were led from the reception to the theatre space in groups of three or four. My guide, in costume as emcee for the evening with face paint, a thick chain around his neck, and a billowing shirt, was Jeff, owner of the theatre and painter of the images I’d seen in the reception as it turned out. He explained with enthusiasm and sincerity, that he wanted to welcome us to the evening and then once inside, he divided our little group up, sending each of us off with a cast member to get a tour of the space.

Jeff was my guide and he started to show me around. And once inside of the Little Red Studio, a tour is appreciated, as we had entered a different world. This was no normal theatre space. The Little Red Studio did not contain rows of seats facing a stage. It felt more like a loft space designed for personal exploration and artistic experimentation.

There were rich colors, plush seats and cushions arranged all over in various configurations, as well as light and dark areas around the room and its various corners and nooks in which different elements of the performance itself laid in waiting for the night to begin. Jeff showed me the main staging area with its shadowy lighting and huge blank canvas against the back wall, a pedastal in the middle of another part ofthe room on which a perfect bodied girl in a tight latex jumpsuit wearing a gas mask stood observing people come in… you know…the usual fare for a night at the theatre.

All around the room, cast members toured other guest/participants through the space, explaining different things to them. A girl with red palm prints over her breasts walked by silently. Different other cast members, (or were they just visions of some kind….or more unsettling and exciting, other visitors to the Studio, just more engaged than I was?), made their way through the space as well, welcoming and preparing us all for the night.

It was difficult to tell who was cast member and who was spectator, but as I quickly realized, the most difficult thing for me to determine that night was whether or not I myself was a cast member or a spectator.

We were invited to take seats around the main performing area, and then the show began. It began without fanfare. It just began. Three butoh figures, came forth from the dark. If you’ve never seen butoh before, it is sort of like your worst nightmare come to life, mixed with delicate grace. The three cast members, looking like aged corposes, and painted head to toe with what looked like pale mud, staggered into the play space. They each were turned by other cast members to face the audience, where they then froze in place.

Each of three cast members who had turned them, proceeded to take a small container of black paint, and proceeded to pour that thick paint over the head of each still figure. As the paint dripped slowly down bodies to the floor, each of the cast members reached back for a martini glass, also filled with paint, and a paint brush. They proceeded to look for people in the audience to whom to hand the glass and brush combo.

This wasnt an empty gesture, or a trite way of suggesting that we might at some point break the “fourth wall”. This was an invitation, which I accepted and which we all did, and within minutes, we were all particpant performers, painting these three ghostly figures ourselves. At the Little Red Studio, there is no fourth wall, or third, second, or first for that matter.

After the body painting, we were asked by our emcee to make our way to another part of the Studio space to see two women writhing and flowing and intertwining in the middle of the floor to music. These women, erotic and sensual and not pornographic, were described by our emcee as goddesses interacting as they want to be seen.

As soon as they were done with their display, we were brought to another area of the space to hear poetry, read slam style, by the very cast members who we’d bodypainted just an bit before.

The cast then invited people to taste chocolate in the center of the space, a richness that made the sensory offerings of earlier in the night very tactile and real. The night then relaxed into an open party for a bit, with dancing, music, and wine flowing as people made their way around and through the space as if it was a nightclub. Performers and spectators interacted as one. This is the Little Red Studio’s idea of an intermission: it was a continuation of the theme.

The Little Red Studio never breaks character because there are no characters to break. Its performers are living their art and they invite you to live yours as well. Like I said, its immersion theatre.

There’s an apprehension with any theatre like this…and for the record, I want to say that there isnt much theatre out there in the world like this, and probably for that very reason: it makes you nervous, albeit in the best possible way. At the Little Red Theatre, you find yourself with that same worry that you might have when an entertainer is looking for a volunteer for his or her show looks in your direction and starts to motion towards you. Its a sense of “do I really want to be here right now?”.

But you do. Because to say no to the experience is to limit life. When it all comes down, I realize again and again that there is so much truth to whoever it was who said “I will never regret the things I have done, just the things I haven’t done.” The Little Red Studio offers you the chance to try things you haven’t done, if you have the courage to say yes to the experience. I found myself excited and intruigued, nervous and at the same time ready for anything.

We reconvened in the main performing space to watch an arial bondage piece that made me want to study knots in which a woman, tied by her partner, is swung around the space from a rig connected to a point in the center of the ceiling. It was seductive, enticing, and unsettling at the same time. He was too good with the knots he tied, and she was too easily tied. I liked it. It made me reflect on power and control, in a passionate context.

We watched the girl who was wearing the gas mask and latex earlier, be body painted on an altar of sorts, now wearing neither latex or mask. She was a vision, perfect, and captivating. All of this screamed of the themes of the night: of sensuousness, richness, life, and avoiding death by delving more into life itself.

Throughout these seemingly disjointed experiences, there is spoken text of course…but not in a traditional sense. Narrators guide us through the expeirence with thoughts death and life and the pursuit of passion. There is a tactile sense to everything, from the words themselves, to the rich red fabric which covers a naked form writhing on the floor, to the ending of the piece, which was the most tactile of all.

The cast assembles in the center of the stage and performers invite by extended hand each member of the audience to approach the cast and stand in front of them…there, the cast showers attention on the audience member, with smiles, with feathers that brush against your face, with laughter, with hands on your arms and eye contact…and you just take it in and say yes to it. It is a ritual of passage from the show back out into the world, and that touch and connection is a feeling more than anything else that you can bring into your day to day lives and continue to long for as you go through the sameness of your day.

And long for it you will, long after the lights in the theatre space come up.

The Little Red Studio offers not just this show but many others. Having had a chance to see their recent two man show on manhood and gender, I can assure you that this is a space that is being well used to challenge, inform, and to forge new theatrical ground in Seattle.

The space deserves your patronage, and even more than that, you, passionate reader, deserve to create space in your life to be there in order to experience it all. Its worth it, and so are you.

In the last few weeks, as I have struggled with my bodies sophisticated, yet debilitating compensation patterns, and face another MRI of my impinged spine, I have been tumbling with the possible reality that it may be time to leave my aerial career behind for good. I am fascinated by my body, its ability to rotate, guard, pinch, splint, and shape around whatever is causing all this purposeful chaos.

And of course, I am scared. However it’s been fun and challenging to re-think my role at the studio, were my being grounded to be the case, and how excited I am to continue branching into other outlets and energy exchanges there.

Gregs words have fueled my passion for the company, the troupe, and what we are collectively sharing with the world. I’ve replenished inspiration and drive regarding my contributions to this entity that has shaped my life so much, enriched my human experience boundlessly, and shown me what it is, for me, to hope and be free. I feel invigorated, released into broader possibilities, and hold an even higher regard for what it is we invoke, and what we are becoming, at LRS. Thank you for sharing your experience with us, Greg.

Greg can be reached with comments and questions through the Little ]]> Frequently, I have difficulty articulating what it is that we do at LRS and what I feel my place is in it all in a fashion that someone outside the troupe can readily assimilate. Often I find challenges in helping my friends and loved ones understand what they’re in for, and how different we are, when they come to see me perform, or share the experience of being a guest at the studio with me.

Recently, I became privy to a poetic, well-written and obviously heartfelt summation of a friends first experience at LRS. I feel very excited and privileged to share it with you, with permission by the author and our creative director.

REVIEW OF The Black Show at THE LITTLE RED STUDIO

The space deserves your patronage, and even more than that, you, passionate reader, deserve to create space in your life to be there in order to experience it all. Its worth it, and so are you.

In the last few weeks, as I have struggled with my bodies sophisticated, yet debilitating compensation patterns, and face another MRI of my impinged spine, I have been tumbling with the possible reality that it may be time to leave my aerial career behind for good. I am fascinated by my body, its ability to rotate, guard, pinch, splint, and shape around whatever is causing all this purposeful chaos.

And of course, I am scared. However it’s been fun and challenging to re-think my role at the studio, were my being grounded to be the case, and how excited I am to continue branching into other outlets and energy exchanges there.

Gregs words have fueled my passion for the company, the troupe, and what we are collectively sharing with the world. I’ve replenished inspiration and drive regarding my contributions to this entity that has shaped my life so much, enriched my human experience boundlessly, and shown me what it is, for me, to hope and be free. I feel invigorated, released into broader possibilities, and hold an even higher regard for what it is we invoke, and what we are becoming, at LRS. Thank you for sharing your experience with us, Greg.

Greg can be reached with comments and questions through the Little Red Studio.

I personally never totally lost the idea I gew up with in school, where VD was about friendship before who’s fucking who, and I wish the mainstream were more about the preservation and honoring ALL your important relationships, than buying a fucking diamond ring for your one ‘sweetie’, but whatcha gonna do. I totally didn’t get anyone anything, so who am I to bitch anyway :P

Happy VD. I had a good one, hope you ]]> I’m not all that big on Valentines, or any of the commercial holidays in general, but one thing about VD that I’ve learned to really appreciate is the acknowledgements from my friends that I receive. Most years I get a number of pings and cards and thinking of you’s, sometimes from people I haven’t really heard from in a long while, and it feels nice.

I personally never totally lost the idea I gew up with in school, where VD was about friendship before who’s fucking who, and I wish the mainstream were more about the preservation and honoring ALL your important relationships, than buying a fucking diamond ring for your one ‘sweetie’, but whatcha gonna do. I totally didn’t get anyone anything, so who am I to bitch anyway :P

Happy VD. I had a good one, hope you did too.