The State of the Errata Project

2011-01-03

jericho

Started sometime in 1999, at least as early as April 17, this Attrition.org project is now over 11 years old. Until the last year, it has been the least popular, least referenced and the creepy uncle of the computer security industry. It has been a subtle reminder of how an industry that sells integrity and security frequently can't turn those concepts inwards.

Working on Errata started as a labor of love, slowly becoming an obligation and moral imperative. These days, it is increasingly difficult to find the time desire to update the project. With each update, with every new charlatan we expose, it is a painful reminder of how polluted our industry is. As we struggle to painstakenly document evidence of wrong-doings, charlatans enjoy more media attention and find new groups of naive people willing to throw money at them for the promise of education, security or investment opportunity.

If you feel the way we do, you are tired of the status quo. It's time to realize that helping the security industry and the general public (our customers) comes in many forms. Developing security software, writing blog pieces, recording podcasts and speaking at cons is great. But at some point, you must realize that you are preaching to the choir 95% of the time. Security people read security blogs, listen to security podcasts and go to security conferences. The customers who are getting suckered by companies and charlatans that care about money instead of integrity suffer.

How You Can Help

Five minutes a week, is all it takes for YOU to help this project, and it can come in many forms. Set a calendar reminder, participate just a little in helping clean up the industry. We're under no illusion that things will magically get better; there is simply too much apathy in this world for that to happen. However, if you won't do it for the greater good, do it as a little fuck you to the people giving you and your industry a bad name.

Building on Aloria's great writeup, here is a short list of ways you can contribute:

• Write your own article or blog piece if an issue is important to you. Use your writing skill to create articulate and compelling arguments with evidence of wrong-doing. Saturation of negative opinion will help, just as the charlatans use saturation to lure journalists and victims in. A single source of this information (this project) is good, but can easily be dismissed as a couple of grumpy people, regardless of how detailed the evidence is.
• Contact the victims. If you see a charlatan on a major media outlet, write to them. Not just via Twitter, but send them e-mail. Failing that, call them and ask to speak to an editor. Publicly document that you did it so there is an audit trail, showing they were warned. Is a company or charlatan peddling services to a school or company? Notify them, politely. Give them a warning of who they are dealing with and encourage them to do research and perform due diligence. Let them make up their mind, just provide them with all of the information needed to make a reasonable decision. Did s/he plagiarize material in a book? Contact the publisher and retailers, demand the book be recalled and an independant review of all of their work be performed. In each case, please CC or BCC errata[at]attrition.org!
• Gather evidence - if you see something that belongs on Errata, send it to us. Pointers, unconfirmed suspicions, links or anything else. We'll investigate as time permits. Realize though, that the backlog of information spans 10 years covering more than 1,500 e-mails and articles. We currently maintain a 'watch list', some of which will be public soon, and prioritize as best we can.
• Skim the books on your shelf: do they contain material that seems familiar? Plug a few phrases into Google, see if the author took shortcuts. Know the author and think s/he is unqualified to write on a topic? Verify the work is original and not full of plagiarism. If you find such instances but don't have the time, send us the book and we'll document everything.

If you find yourself too busy for all that, feel free to donate a few bucks to us to make yourself feel better. In addition to the items listed on the 'donate' page, money will be used to purchase books with suspected plagiarism. Even used, many of these books are still $15 to $20 with shipping and it begins to add up.

Finally, the other wish list; we're looking for copies of a few books for archiving. We do not have copies of some books exposed on our pages, and we'd like one (used is fine):

[Updated: This list is now maintained on a separate page and updated frequently.

Thank you for your continued support in the Errata Project. This project could not continue without the assistance of several people, including Lyger, CJI, Quine and Cupcake (when she finishes the damn graphics!@$).