Marc Liberatore

Don't make me tap the sign

Thu, 16 Apr 2026 09:00:00 -0500

Believe what you will about the utility of LLMs, and whether they produce useful output or not. But now that they exist, every system that is or was regulated in some way by the production of a legible signal of human effort (problem sets, letters of reference, essays, govenment filings, lawsuits, and on and on) will break, to varying degrees.

Received the Faculty Distinguished Teaching Award

Thu, 16 Apr 2026 09:00:00 -0500

I am honored to learn I have been named a recipient of the 2025-26 Distinguished Teaching Award, which honors exemplary teaching at UMass Amherst.

Not admitting graduate students or hiring assistants/staff in AY25-26

Mon, 05 May 2025 12:00:00 -0500

I am not able to admit graduate students (MS or MS/PhD or PhD) or hire assistants (TAs/RAs) or other positions (graders, engineers, interns, etc.). Nor am I taking on new advisees or planning to do so in the forseeable future. Please don’t solicit me on these topics, as unfortunately I will not be able to help you.

Terminal MS students in CICS should also note that the College generally bars them from receiving assistantships anywhere on campus (not just within CICS). See the last section, “Campus Employment,” of our MS requirements page.

Using Thunderbird (SMTP/IMAP) with Microsoft Exchange 365 and Modern Authentication at UMass Amherst

Tue, 01 Feb 2022 12:00:00 -0500

Update 2022-08-04: I’m told that UMass changed its Azure authentication policy in late June, and Thunderbird now once again works out-of-the-box with UMass’s Office 365 mail service.

UMass recently upgraded many of its systems to use OAuth2 and two-factor authentication aka “modern authentication” (without allowing fallback to username/password only, aka “legacy authentication”). As a security nerd, I applaud this move! But it does mean that Thunderbird die-hards in units who use Microsoft Exchange 365 as their mail server, things don’t “Just Work” anymore. IMAP (that is, reading mail) still works, but SMTP (sending mail) does not.

Campus IT doesn’t support Thunderbird, but a friend of mine was able to get Thunderbird working. She kindly agreed to write up her experiences. If you are a kindred spirit, perhaps this will be of help!

Dear Fellow Thunderbird Die-Hards,

If you are a Thunderbird user who hates the thought of being forced to spend half your working day dealing with Microsoft Exchange, you are not alone!

And if you are going nuts because you haven’t yet figured out how to keep using Thunderbird following your department’s conversion to Microsoft Exchange and the (more recent) rigorous enforcement of dual-authentication, read on!

(Note before going further: I use Linux, so it’s possible things may look a little different for you if you use some other operating system.)

When Thunderbird suddenly stopped working a couple weeks ago, I poked around and learned that UMass was now using an authentication method known as “OAuth2” (dual authentication). I fussed with the Thunderbird account settings, changing the authentication method to OAuth2 under Account Settings: Server settings. This seemed to do the trick for incoming mail, but no amount of changing the outgoing server (SMTP) settings made it possible for me to send mail using my UMass account.

Out of desperation, I created a new personal email address and started sending mail from that, but Outlook decided to treat those emails as junk, so UMass colleagues typically weren’t getting my messages. (I’m not quite paranoid enough to believe this was retaliation from Microsoft AI for trying to get around it. Almost, but not quite.)

Then my excellent friend and MSP Co-President Marc Liberatore tipped me off about Exquilla. You have to pay for it, but it’s only around $11 per year. I quickly decided I didn’t mind paying people a bit to help me keep using Thunderbird.

To get Exquilla working for me, here’s what I did:

I updated Thunderbird to the most recent release (91.5.0).
I paid the people at Exquilla (https://www.exquilla.com/) by giving them my name, email address (I used my regular UMass address in both the “Email address” and “Exchange email” fields), and credit card info. I then got a confirmation email saying that I had paid and that it should work automatically without my needing to do anything further. I hope that’s true for you, but it wasn’t for me…
In Thunderbird, I opened “Add-ons and Themes” in the hamburger menu (top right). Under Extensions, I enabled Exquilla for Exchange.
- I clicked on the wrench icon.
- I clicked “Add new account manually.”
- I entered my regular UMass username and password and clicked “Next.”
- Then came a very frustrating period where I couldn’t get it to work. This is where it needs the Exchange Web Services (EWS) URL. There’s an option to have it auto-detect, but it kept failing. There’s also an option to type it in manually, so I hunted around the UMass website and found one document that listed the EWS URL as https://exchange.umass.edu/ews/exchange.asmx. This was actually the same as the URL it was finding when it auto-detected, and it kept failing here as well. I just kept trying and then it finally worked (I’m pretty sure it worked while auto-detecting, but either way should be the same). I wish I could tell you what changed, but I can’t—I just hope it’s smoother for you! (Note: at some point in the process, it did run through the duo-authentication, including calling my phone. I can’t remember when that was, but I do remember that it still didn’t install properly at that point. It kept failing for a bit before finally the whole thing suddenly came together, for what reason I do not know.)
Even after that, I was still having some trouble sending mail: it would send, but it would hang at the point where it was supposed to “assemble” the message and save it to my sent folder. What I finally determined is that the new system is simply not going to let me save my sent messages directly to a local folder as I used to do. Under Account Settings: Copies & Folders, make sure it’s set to save in the folder “Sent on username@umass.edu on outlook.office365.com.”

Also, notice that in addition to your regular account(s) and local folders in the left panel, if you scroll all the way down that panel you should see a new account, which is “username@umass.edu on outlook.office365.com.” I made sure the settings under Account Settings: Copies and Folders were correct there as well. Under that account, you’ll see a “Sent items” folder, which is where you can find copies of emails that you’ve sent. I just periodically go and scoop those up and move them to the local folder where I like to keep them—it doesn’t seem to mind my doing that, but it did object (i.e., failed to work) when I tried to set it to put them there automatically.

Otherwise, I don’t actually do anything with the new account (except deal with the junk folder—hooray! I no longer have to log in to Outlook to sort junk!). I continue to use the inbox for the account I originally had at the top of the left panel, and it works just fine for incoming and outgoing.

You might also try this web page (https://exquilla.zendesk.com/hc/en-us/articles/212909826-Configuring-the-outgoing-server) if you’re having trouble sending mail—it was one of several things I consulted, and it may have helped, though I’m not sure.

In sum, don’t give up! And good luck!

Statistical Detection of Downloaders in Freenet

Mon, 09 Nov 2020 00:00:00 +0000

Answers for Prospective Undergraduates

Mon, 12 Oct 2020 09:41:18 -0400

Every fall I get emails from prospective undergraduates asking questions about UMass and our programs in CICS.

These questions and requests are usually one or more of the following:

How would you rate the X at UMass, where X is one or more of:
- undergraduate life
- the undergraduate CS program
- the faculty in CS
Tell me why I should I choose UMass over other schools.
Will I get to take a class with a particular professor?
Will I get a top internship/job placement?
Will I get to do undergraduate research?

This post is a collection of my thoughts on these topics.

(In particular, it is not a reflection of UMass’s or CICS’s official positions on these questions, which you can learn more about here and here, respectively.)

Rate undergraduate life at UMass. I dunno, it seems fine? Students in my classes seem to like it, for the most part. You’re asking an old man this question! It was fine when I was an undergraduate here more than 20 years ago but things are different now.

The factual stuff I can tell you is more about buildings than student life. Like many schools, over the last 10-15 years UMass has spent a bunch of money upgrading facilities that are student-facing. The food is fantastic. The new rec center is mostly great (~~only three power racks? what the actual eff?~~ Update 2022: They added more racks!). Newer classrooms are like spaceships. The new dorms have %&*#ing air conditioning! There is wireless (for better or for worse) basically everywhere. This is all great, and way better than the clown show that was going on back in the mid-90s, when we were reduced to stringing ethernet between dorm windows or putting up with whacko 19.2 digital modems.

Rate the undergraduate CS program at UMass. Mostly good, though of course the classes I teach are particularly amazeballs.

More seriously: Like the programs at most larger schools, there’s some lag in the curriculum’s adaptation to what is currently hot in CS, but there’s reasonably good coverage of most students’ areas of interest in upper-level electives, and that’s something you might not get at a smaller liberal-arts school.

One reason to pick a larger school like UMass over a school with a smaller CS program is the depth and breadth of course offerings available. The other side of this tradeoff is that generally the enrollment in CS courses is much higher at a school like UMass, so you’ll get less individual faculty attention than you might at a smaller school.

Rate the CS faculty. You’re asking me to judge my colleagues publicly. Come on. Go look at US News and World Report, or RateMyProfessor, or whatever.

More candidly: Just like anywhere, there are people with different strengths, weaknesses, and areas where they choose to focus their energy. The administration is definitely cognizant of these factors, and generally does a good job of matching faculty interest and teaching skills with appropriate classes.

For tenure-line faculty, there can be a real tension when allocating time between teaching and research, though many bring their research into the classroom and students really benefit from it.

UMass is somewhat unusual among our peer institutions in that we don’t have “disposable adjuncts” – poorly treated faculty who are hired on a contingent basis. Instead we have “lecturers,” faculty who focus their energy on teaching and who have competitive pay and job security. (At some schools they have the title “Teaching Professor,” though for various legal reasons we don’t do that here, yet.) Many of our introductory CS courses are taught by teaching faculty, people who are specifically interested in the teaching of undergraduate CS courses. As such, they tend to be higher quality than you might expect from naively looking at the numbers.

Why should I choose UMass? There’s a lot packed into this question.

First, you should know that like all reasonably-ranked CS programs, UMass’s is overrun by applicants. High-schoolers applying, transfer students from other colleges, and internal applicants to the major – in all of these areas, there has been and continues to be more applicants than we generally have seats for.

Here at UMass we’re doing everything we can to expand our capacity, as we take our role as a public university providing access to all seriously. But it remains the case that no-one here or at a comparable program is likely to spend significant amounts of their time wooing you to choose them or explaining why they stand out from the crowd. This is especially true if you’re even asking this question. A particular University might do so (especially if you’re from out-of-state and willing to pay full tuition), but that’s a different story and above my pay grade.

Speaking of that: If you just have a generic interest in CS and/or programming, then UMass is a great deal – for in-state students. If you are from out-of-state, then it’s a less compelling value proposition. Your own state school is likely fine, and in some cases ranked competitively or above UMass. Lookin’ at you, UIUC, UC-B, etc.

If there’s something specific to the UMass program you’re interested in, that may change the calculus somewhat and induce you to come here from out-of-state. For example, if you want access to faculty and classes in areas where our faculty are well-known, or if you want to join our Informatics program, or if you’re an international student looking to come to the US, or if your own state school doesn’t accept you because it’s too exclusive, etc. Lookin’ at you, UC-B, etc.

Why would you choose UMass over a liberal arts college? Because you want the breadth and depth we (or any large, world-class university) can offer, not just in CS but in many academic areas. The other side of this tradeoff, though, is that you’re unlikely to get the individual faculty attention that is a selling point at most smaller colleges. Another reason to choose a large University is that things change! You might discover that what you really enjoy about CS is the mathematical aspect, and want to change majors to Mathematical Computing. Or, you might discover a passion for medieval English literature, or comparative political science, or epidemiology, or biostatistics, or who knows what else. A large school can give you the opportunity to pursue any of these interests in a way that a small school cannot.

Will I get to take a class with a particular professor? Hard to know the future! Check the teaching schedule for what they’ve done historically. You can also write to them and ask if they expect to be teaching the course you’re interested in some particular future year. It’s unlikely they’ll be certain, but they can at least let you know if they’re planning to be on sabbatical or the like that year.

Will I get a top internship/job placement? Hard to know the future! Many of our students get placed in great spots. We have an entire staff who work with students on job preparation and the like. Learn more at CICS Careers.

Will I get to do undergraduate research? (Often paired with “can I get into a top graduate school after completing UMass’s program?”) Maybe!

Some faculty love working with undergraduates and have or make the time to do so. This is often but not always done through the Honors College’s various programs that encourage undergraduate research.

But in the interests of full disclosure, faculty in “hot” areas are generally overrun with students asking to work with them, and tenure-line faculty in particular need to optimize their time usage for getting tenure as much as possible. Generally, this means working with graduate students, not undergraduates. But, some faculty who generally don’t work with undergrads directly still have lab setups where grad students work with undergrads. And these same hot areas tend to have associated student clubs that provide a structured way to dive into a subject area outside of classes and direct faculty interaction.

In terms of graduate school, assuming you’re talking about a PhD program, one of the best things you can do is work with someone – ideally a faculty member or senior graduate student – on a research project and to make a meaningful contribution to it. Their letter in support of your application will be worth far more than a good transcript and/or generic letter of support from your undergraduate advisor. (MS programs tend to be easier to get into; for most students, good grades from a reasonable undergraduate institution are typically enough.)

A Gentle Graphical Introduction to Recursion

Mon, 07 Oct 2019 10:10:00 -0400

These are notes from an in-class exercise on recursion I did in a First Year Seminar. The basic idea is an old one: to draw a tree recursively.

(This particular exercise is directly inspired by a talk Dan Garcia gave at a recent SIGCSE about part of their CS 10 (CS Principles) class, The Beauty and Joy of Computing.)

Recursion and fractals

Many things can be expressed “recursively” that is, partly or wholly in terms of themselves. This is usually where your CS teacher immediately brings up factorial. BUT I WILL MANFULLY RESTRAIN MYSELF!

Instead, I’ll point out two things to get us started:

First, that recursion is a beautiful, simple (though maybe not easy) way to think about computation. The dual of the Turing machine is the lambda calculus, and it’s elegantly powered by recursion.

Second, that recursion is all around us in nature, in the form of fractals, which when used colloquially means “things that are similar to themselves over extended, but finite, scales.” (Show some examples from Wikipedia.)

We’re going to explore the concept of recursion graphically today, rather than with factorials and Fibonacci and the like. Well, I will probably do a little bit of factorial stuff at the end, but only because I’m contractually required.

Getting started

So, we’re going to learn to draw beautiful trees that look like this (slides).

But we’ll start with something simpler).

The important thing to see is that this tree is self-similar; in other words, it’s fractal: each part contains smaller versions of itself. (on board)

We’re going to draw this in Processing. But first, some preliminaries.

Setting up processing

Processing lets you do pretty arbitrary things (it’s Java, after all). We’re going to tame the complexity somewhat by doing “turtle graphics” aka “pen graphics.” In other words, we’re going to draw everything in terms of pen. The pen has three pieces of state: X, Y, and direction. This is similar to a turtle with a pen attached crawling around on a piece of paper, or my hand on the board, sorta.

float penX;
float penY;
float penDirection;

OK. So far, so nothing. Let’s set up the sketching area:

void setup() {
  size(600, 600);
  penX = width / 2;
  penY = height / 2;
  background(255);
  noLoop();
}

Line by line, what’s happening here?

size(600, 600); creates a viewable (x, y) rectangle to draw on – it’s the sketch, in Processing lingo. The x coordinates increase left to right, and the y coordinates increase top to bottom. This is the opposite of algebra y-axes! But it is common in graphics.

penX = width / 2; and the following line center the pen on the x/y coordinates.

background(255); sets the entire background to white. If you pass a value on the range 0…255 as a color, Processing interprets it as a shade of grey (0 = black, 255 = white).

noLoop(); tells Processing that once we start to draw, call draw() only one time; otherwise (by default) it is called repeatedly in an endless loop.

Now, let’s teach processing how to move the pen:

void move(float amount) {
  float newX = penX + sin(radians(penDirection)) * amount;
  float newY = penY - cos(radians(penDirection)) * amount;
  
  line(penX, penY, newX, newY);
  
  penX = newX;
  penY = newY;
}

This is a three-step process. First we have to compute where we’re going, on the basis of where we are. We use trig to figure out how far away in the x and y directions we need to go (remember, y is flipped, hence the minus). We draw a line from the pen’s current location to its new location. Then we update the pen’s location.

Let’s test it out in a draw() method:

void(draw) {
    move(50);
}

OK, that works. What about if we want to turn?

void turn(float degrees) {
  penDirection += degrees;
}

void(draw) {
    move(50);
    turn(90);
    move(50);
    turn(90);
    move(50);
    turn(90);
    move(50);
    turn(90);
}

Great. How about a random walk?

void draw() {
  turn(random(360));
  stroke(random(255), random(255), random(255)); // random pen color each time, RGB when you pass three values
  move(random(20));
}

And how about we use the mouse to turn it on and off?

void mousePressed() {
  loop();
}

void mouseReleased() {
  noLoop();
}

OK, now we’re cooking!

Drawing a tree

So, back to our drawing: notice that each tree is made up of smaller trees. We’re going to write a tree method that draws a tree? It’ll start with a move() call to draw the trunk, then it will turn left, draw the smaller tree, turn right, draw the smaller true, and go back to where it started.

In other words, It’ll start with a move() call to draw the trunk, then it will turn left, draw the smaller tree using tree(), and so on.

“Hey dawg, I heard you liked trees inside of your trees, so can you show me how I can use tree() inside of tree() to draw a tree?” That’s today’s magic.

No recursion here

First write tree1. All it does is draw the trunk by moving forward size and then backward size:

void tree1(float size) {
  move(size);
  move(-size);
}

Make sure it works:

void draw() {
    tree1(100);
}

Maybe also move the root of the tree down a bit:

// in setup()
penY = height * 0.9

Now, let’s draw a two-level tree.

void tree2a(float size) {
  move(size);
  turn(-15);
  move(size * 0.75);
  move(-size * 0.75);
  turn(30);
  move(size * 0.75);
  move(-size * 0.75);
  turn(-15);
  move(-size);
}

At this rate, it’s gonna take a lot of code to draw a beautiful tree. Don’t worry, though, we’ll get better.

Does everyone understand what’s happening above? (Trace through on board.)

More levels

OK, let’s simplify a bit. Do you see that tree2a contains tree1 if you stop and squint at it a bit? Let’s rewrite it to use tree1:

void tree2(float size) {
  move(size);
  turn(-15);
  tree1(size * 0.75);
  turn(30);
  tree1(size * 0.75);
  turn(-15);
  move(-size);
}

Now, I want you to write a tree3 that uses tree2. It should not use tree1. (Hint: it looks almost exactly like tree2; copy/paste and change three characters).

void tree3(float size) {
  move(size);
  turn(-15);
  tree2(size * 0.75);
  turn(30);
  tree2(size * 0.75);
  turn(-15);
  move(-size);
}

How would tree4 look? Exactly the same, except it would call tree3. So, here’s the big idea: we can write a tree method that uses itself to draw a tree, so long as it knows how many levels it’s expected to draw.

A Recursive `tree`

tree will need a levels parameter in addition to size:

void tree(int levels, float size) {
    move(size);
    turn(-15);
    tree(levels - 1, size * 0.75);
    turn(30);
    tree(levels - 1, size * 0.75);
    turn(-15);
    move(-size);
}

What happens when we run this in our draw() method?

As Processing helpfully explains, there’s a problem with our recursion. Let’s think about what’s going on. (on board, trace operation with levels = 2)

The problem is that the methods we wrote before aren’t all exactly the same: tree1 in particular just drew a trunk, and no branches. So, we need a special case to handle this:

void tree(int levels, float size) {
  if (levels == 1) {
    move(size);
    move(-size);
  }
  else {
    move(size);
    turn(-15);
    tree(levels - 1, size * 0.75);
    turn(30);
    tree(levels - 1, size * 0.75);
    turn(-15);
    move(-size);
  }

And now it works. Let’s try a larger levels for a prettier tree. (show 9)

This general code pattern, with a simple base case that doesn’t call the method itself, and a less simple case that does call itself, is typical of recursive code. Let’s break it down:

void tree(int levels, float size) {
  // the base case; a problem so simple we know how to handle it
  // completely
  if (levels == 1) {
    move(size);
    move(-size);
  }
  // the recursive case
  // do a small part here, and delegate the rest to somebody else
  else {
    // draw the trunk
    move(size);
    // position the pen for the left sub-tree
    turn(-15);
    // delegate drawing the left sub-tree to someone else
    tree(levels - 1, size * 0.75);
    // re-position for the right sub-tree
    turn(30);
    // delegate drawing the right sub-tree to someone else
    tree(levels - 1, size * 0.75);
    // re-position to go back to the start
    turn(-15);
    // retrace our steps back to where we started
    move(-size);
  }

Notice that in the recursive case, we are always making progress toward the base case – here, levels is guaranteed to be decremented by one each time the method calls itself, so we’re guaranteed (mostly) to hit levels == 1 and stop. If we don’t do this, the method calls itself indefinitely, and we end up with a StackOverflow (at least in Java).

What would happen if we started with levels < 1?

Sometimes a recursive program is more elegant if you have a smaller base case. What would a “zero level” tree mean? Can you rewrite the program to have a base case where levels == 0?

Some questions

(slides)

An exercise

Try to draw a more “beautiful” tree. Two things that might help:

strokeWeight(5);

makes the stroke (the ink left by the pen) five pixels wide instead of one.

And you can change the color by red green blue components. Google has a nice color picker to help.

stroke(75, 160, 15); // kinda greenish

Other comments on recursion

Of course we can define factorial recursively, too. And write in in Java. And probably you can trivially transform it to its iterative form. There’s a deeper truth here, that all recursive algorithms have an iterative equivalent (and vice versa), though the problem of designing the algorithm might yield more easily to one or other. For example, how would you draw a tree of arbitrary depth iteratively? For the supernerds: without a stack?

And, some other languages make use of recursion and recursive definitions much more natural than Java. For example, here’s a snippet of OCaml to computes the factorial:

let rec factorial = function 
  | 0 -> 1
  | x -> x * factorial (x - 1)
;;

print_int (factorial 10)

It’s like a direct transcription of the mathematical description!

Server-side traffic analysis reveals mobile location information over the Internet

Thu, 20 Jun 2019 00:00:00 +0000

College Outstanding Teacher Award

Tue, 02 Apr 2019 11:06:11 -0400

I am honored to have been selected to receive the CICS Outstanding Teacher Award.

The College Outstanding Teacher Award (COTA) program was instituted as a complement to the Distinguished Teaching Award and is administered by the Provost’s Office and the individual colleges. The purpose of the award is to honor faculty members for their teaching accomplishments at the college level. The awards are given during the spring semester, and recipients are recognized at Undergraduate Commencement.

Forensic Identification of Anonymous Sources in OneSwarm

Wed, 01 Nov 2017 00:00:00 +0000

Statistical Detection of Downloaders in Freenet

Thu, 25 May 2017 00:00:00 +0000

Innovation with Scale

Sat, 08 Apr 2017 00:00:00 +0000

Innovation with Scale

Thu, 06 Apr 2017 09:01:01 -0400

The members of teaching faculty in CICS at UMass are going to the College of St. Rose this Saturday, April 8th, to give a panel presentation on Innovation with Scale at CCSCNE 2017.

Being an effective teacher is challenging; to do so when your enrollment doubles or triples can be overwhelming. To teach at scale requires the application of new teaching strategies, techniques, and tools to meet the demands of increasing enrollment. These large classes also present opportunities to innovate, either in terms of pedagogy or via inclusion of technological solutions. Where faculty may have been able to rely on charm and charisma as means of connecting to students, large lectures make connecting to students difficult. Research has shown that learner-centered strategies affect student perceptions of their learning, and that peer-based instruction and mentoring improve student outcomes. Our panel seeks to share a range of adaptations, innovations, and practical strategies for facilitating rich learning experiences for undergraduates in large learning environments.

Nominated for a Distinguished Teaching Award

Mon, 14 Nov 2016 12:00:00 +0000

I have been nominated for a 2016–2017 Distinguished Teaching Award (DTA), a campus-wide student-driven recognition of teaching, for my teaching of COMPSCI 190D this semester.

COMPSCI 190D (Using Data Structures) and 365/590F (Digital Forensics)

Mon, 24 Oct 2016 12:00:00 +0000

Next semester (Spring 2017) I am teaching two courses: COMPSCI 190D: Using Data Structures and COMPSCI 365/590F: Digital Forensics.

CICS handles course wait lists centrally. If during preregistration (or add/drop) SPIRE indicates a course requires department consent, or that it is full and you want to get on a wait list, please request an override.

COMPSCI 190D

COMPSCI 190D is intended for students who have completed COMPSCI 121. It will focus on using, rather than implementing and analyzing, the data structures now studied in COMPSCI 187, along with additional structures (such as sets and maps) which are not covered there but that are useful for practical programming.

For some students, 190D can serve as an alternative to 187. It will be recognized as one of the core courses for the proposed Informatics major, and the practical programming with data structures in 190D will be adequate preparation for some courses such as COMPSCI 326.

Computer Science majors (both BA and BS) must still take 187, which is a prerequisite for all the 200-level core courses. But the College of Information and Computer Sciences (CICS) hopes that many majors and applicants to the major will find 190D to be good additional advance preparation for 187.

COMPSCI 365/590F

Undergraduates COMPSCI majors with a strong technical background (COMPSCI 220 or 230) and an interest understanding the technical aspects of digital forensics. This course counts as a COMPSCI elective toward the major (B.S. or B.A.). Graduate students who enroll in 590F will also find the material topical to their program of study and to their professional development. They should expect to cover more of the details, both technical and legal, than the undergraduates enrolled in 365.

COMPSCI 190D: Using Data Structures

Tue, 10 May 2016 12:15:00 +0000

Next semester (Fall 2016) I am teaching COMPSCI 190D: Using Data Structures. COMPSCI 190D is intended for students who have completed COMPSCI 121. It will focus on using, rather than implementing and analyzing, the data structures now studied in COMPSCI 187, along with additional structures (such as sets and maps) which are not covered there but that are useful for practical programming.

CICS handles course wait lists centrally. If during preregistration (or add/drop) SPIRE indicates the course requires department consent, or if it is full and you want to get on the wait list, please request an override.

COMPSCI 391L/591L: Computer Crime Law

Tue, 10 May 2016 12:00:00 +0000

Next semester (Fall 2016) I am teaching COMPSCI 391L/591L: Computer Crime Law. COMPSCI 391L/591L is a study, analysis, and discussion of the legal issues related to crimes involving computers and networks, including topical actions by dissidents and governments. We will also study the technologies of forensic investigation, intelligence gathering, privacy enhancement, and censorship resistance.

Our main legal topics will include recent and important case law, statutes, and constitutional clauses concerning authorization, access, search and seizure, wiretaps, the right to privacy, and FISA. Our technology topics will include methods of investigation and resistance in the context of the Internet and Cellular networks. Students are assumed to have no background in legal concepts. All students will be required to complete substantial legal readings, complete significant written analysis of rulings, learn about technologies in detail, and participate in lively class discussion. Graduate students enrolled in 591L will be expected to read selected current law and technical articles and to analyze state-of-the-art systems in the context of law and policy.

Joining the CICS Faculty

Mon, 09 May 2016 12:00:00 +0000

I will be joining the CICS faculty as a lecturer in Fall 2016.

Lecturers in CICS have many responsiblities, including teaching up to six courses per year (or equivalent based on other duties and activities) at both the undergraduate and MS level, curriculum development, and undergraduate advising, as well as additional administrative and scholarly duties as determined by the Chair of the Faculty.

Joined the PETS 2017 TPC

Wed, 24 Feb 2016 14:00:00 +0000

I’ve joined the PETS 2017 TPC. The Privacy Enhancing Technologies Symposium is the premier venue for novel research on the theoretical and practical aspects of privacy technologies. Please submit your work!

As of 2015, PETS has moved to an open-access journal/conference hybrid model. Articles are submitted for review to an issue of the PoPETs open-access journal, and accepted articles are made freely available online by De Gruyter: http://www.degruyter.com/view/j/popets. Since this change, we have seen an increase in the number and diversity of submissions. We believe that the major revisions model has also led to an increase in quality of the accepted publications.

The PETS event consists of presentations of articles accepted to PoPETs, as well as keynotes, associated workshops such as HotPETs, and a range of social activities.

Characterization of Contact Offenders and Child Exploitation Material Trafficking on Five Peer-to-Peer Networks

Mon, 01 Feb 2016 00:00:00 +0000

CyberCorps® Scholarship for Service at UMass

Tue, 26 Jan 2016 11:00:00 +0000

UMass has been awarded an NSF CyberCorps® Scholarship for Service grant (DGE-1565521). In short, undergraduate or graduate students who are U.S. citizens or permanent residents and studying cybersecurity are eligible for tuition and fee waivers and generous stipends.

To apply, visit the UMass SFS page.

More information is available in the official press release.

Discovering Specification Violations in Networked Software Systems

Mon, 02 Nov 2015 00:00:00 +0000

Nominated for a Distinguished Teaching Award

Tue, 20 Oct 2015 15:30:00 +0000

I have been nominated for a 2015-2016 Distinguished Teaching Award (DTA), a campus-wide student-driven recognition of teaching, for my teaching of CMPSCI 187 last semester.

(DTA selection evaluations are only conducted when nominees teach during a Fall semester. I am not teaching this semester, so I must defer my nomination.)

COMPSCI 290NW: A Networked World

Wed, 30 Sep 2015 15:30:00 +0000

Next semester (Spring 2016) I am tentatively scheduled to be the instructor for COMPSCI 290NW: A Networked World. Last offered in Fall 2014, COMPSCI 290NW is not intended for CS majors, but it is an excellent introduction to networking, the Internet, and related technologies for non-majors. It is of particular interest to students pursuing the IT minor and for (BDIC) Informatics majors.

The College of Information and Computer Sciences handles course wait lists centrally. If during preregistration (or add/drop) SPIRE indicates the course is full and you want to get on the wait list, please request an override.

Discovering Specification Violations in Networked Software Systems

Thu, 06 Aug 2015 12:00:00 +0000

Discovering Specification Violations in Networked Software Systems, written in collaboration with Robert Walls, Yuriy Brun, and Brian Levine, has been accepted to the IEEE International Symposium on Software Reliability Engineering (ISSRE 2015).

From the abstract:

Publicly released software implementations of network protocols often have bugs that arise from latent specification violations. We present APE, a technique that explores program behavior to identify potential specification violations. APE overcomes the challenge of exploring the large space of behavior by dynamically inferring precise models of behavior, stimulating unobserved behavior likely to lead to violations, and refining the behavioral models with the new, stimulated behavior. APE can (1) discover new specification violations, (2) verify that violations are removed, (3) identify related violations in other versions and implementations of the protocols, and (4) generate tests. APE works on binaries and requires a lightweight description of the protocol’s network messages and a violation characteristic. We use APE to rediscover the known heartbleed bug in OpenSSL, and discover one unknown bug and two unexpected uses of three popular BitTorrent clients. Manual inspection of APE-produced artifacts reveals four additional, previously unknown specification violations in OpenSSL and μTorrent.

Sybil-Resistant Mixing for Bitcoin

Sat, 01 Nov 2014 00:00:00 +0000

CMPSCI 187: Programming with Data Structures

Fri, 31 Oct 2014 12:00:00 +0000

Next semester (Spring 2015) I am the instructor (with John Ridgway) for CMPSCI 187: Programming with Data Structures.

Computer Science handles course wait lists centrally. If SPIRE indicates the course is full and you want to get on the wait list, please request an override.

Joined the PETS 2015 TPC

Tue, 09 Sep 2014 12:00:00 +0000

I’ve joined the PETS 2015 TPC. The Privacy Enhancing Technologies Symposium is the premier venue for novel research on the theoretical and practical aspects of privacy technologies. Please submit your work!

More PETS news

New this year, the proceedings of PETS is now PoPETS, a scholarly journal for timely research papers on privacy that brings journal-style reviewing to conference-style papers and seeks to combine the benefits of fast conference turnaround with consistent journal reviewing. PETS/PoPETs has been modeled on the success of other conference/journal hybrids such as JETS and PVLDB.

Authors can submit papers to one of several submission deadlines during the year. Papers are provided with major/minor revision decisions on a predictable schedule, where we endeavor to assign the same reviewers to major revisions. Authors can address the concerns of reviewers in their revision and rebut reviewer comments before a final decision on acceptance is made. Papers accepted for publication by May 15th will be presented at that year’s symposium. Note that accepted papers must be presented at PETS.

Efficient Tagging of Remote Peers During Child Pornography Investigations

Mon, 01 Sep 2014 00:00:00 +0000

Sybil-Resistant Mixing for Bitcoin

Mon, 25 Aug 2014 17:00:00 +0000

My paper Sybil-Resistant Mixing for Bitcoin, written in collaboration with George Bissias, Pinar Ozisik, and Brian Levine, has been accepted to the Workshop on Privacy in the Electronic Society workshop, held in conjunction with the ACM Conference on Computer and Communications Security.

From the abstract:

A fundamental limitation of Bitcoin and its variants is that the movement of coin between addresses can be observed by examining the public block chain. This record enables adversaries to link addresses to individuals, and to identify multiple addresses as belonging to a single participant. Users can try to hide this information by mixing, where a participant exchanges the funds in an address coin-for-coin with another participant and address. In this paper, we describe the weaknesses of extant mixing protocols, and analyze their vulnerability to Sybil-based denial-of-service and inference attacks. As a solution, we propose Xim, a two-party mixing protocol thatis compatible with Bitcoin and related virtual currencies.

It is the first decentralized protocol to simultaneously address Sybil attackers, denial-of-service attacks, and timing-based inference attacks. Xim is a multi-round protocol with tunably high success rates. It includes a decentralized system for anonymously finding mix partners based on ads placed in the block chain. No outside party can confirm or find evidence of participants that pair up. We show that Xim’s design increases attacker costs linearly with the total number of participants, and that its probabilistic approach to mixing mitigates Sybil-based denial-of-service attack effects. We evaluate protocol delays based on our measurements of the Bitcoin network.

Joined the DFRWS 2015 TPC

Fri, 22 Aug 2014 09:15:00 +0000

I’ve joined the DFRWS 2015 TPC. DFRWS is the leading digital forensics research conference. If you’re doing work in the field on one of the many topics of interest, please submit a writeup! The tentative submission deadline is February 9th, 2015.

CMPSCI 383: Artificial Intelligence

Wed, 28 May 2014 12:32:00 +0000

Next semester (Fall 2014) I am the instructor for CMPSCI 383: Artificial Intelligence.

Computer Science handles course wait lists centrally. If SPIRE indicates the course is full and you want to get on the wait list, please request an override.

Location Privacy without Carrier Cooperation

Thu, 01 May 2014 00:00:00 +0000

Location Privacy without Carrier Cooperation

Tue, 29 Apr 2014 10:57:00 +0000

My paper Location Privacy without Carrier Cooperation, written in collaboration with Keen Sung and Brian Levine, has been accepted to the Mobile Security Technologies workshop, held as part of the IEEE Computer Society Security and Privacy Workshops, in conjunction with the IEEE Symposium on Security and Privacy.

From the abstract:

Cellular network operators can track the location of cell phone users as they connect to different towers. Operators may not directly control the user’s phone, but they do supply and control the SIM card that identifies the user. We seek to preserve a cellular phone user’s location privacy from cellular network operators. We propose the ZipPhone protocol for secure, virtual, and therefore easily changeable SIM cards. ZipPhone breaks the association between the user and IMSI identifier, and thus prevents the cellular operator from localizing the user.

CMPSCI 290NW: A Networked World

Wed, 09 Apr 2014 15:00:00 +0000

Next semester (Fall 2014) I am the instructor for CMPSCI 290NW: A Networked World.

Computer Science handles course wait lists centrally. If SPIRE indicates the course is full and you want to get on the wait list, please request an override.

Measuring a year of child pornography trafficking by U.S. computers on a peer-to-peer network

Sat, 01 Feb 2014 00:00:00 +0000

CMPSCI 453: Computer Networking

Thu, 16 Jan 2014 15:30:00 +0000

This semester (Spring 2014) I am the instructor for CMPSCI 453: Computer Networking. All course material will be posted (or linked to) at the course website.

Joined the DFRWS 2014 TPC

Mon, 02 Dec 2013 12:00:00 +0000

I’ve joined the DFRWS 2014 TPC. DFRWS is the leading digital forensics research conference. If you’re doing work in the field on one of the many topics of interest (as described in the CFP), please submit a writeup! The submission deadline is February 13th, 2014.

Measuring a year of child pornography trafficking by U.S. computers on a peer-to-peer network

Wed, 23 Oct 2013 20:18:00 +0000

My paper Measuring a year of child pornography trafficking by U.S. computers on a peer-to-peer network, written in collaboration with Janis Wolak and Brian Levine, has been accepted to Child Abuse & Neglect.

From the abstract:

We used data gathered via investigative “RoundUp” software to measure a year of online child pornography (CP) trafficking activity by U.S. computers on the Gnutella peer-to-peer network. The data include millions of observations of Internet Protocol addresses sharing known CP files, identified as such in previous law enforcement investigations. We found that 244,920 U.S. computers shared 120,418 unique known CP files on Gnutella during the study year. More than 80% of these computers shared fewer than 10 such files during the study year or shared files for fewer than 10 days. However, less than 1% of computers (n = 915) made high annual contributions to the number of known CP files available on the network (100 or more files). If law enforcement arrested the operators of these high-contribution computers and took their files offline, the number of distinct known CP files available in the P2P network could be reduced by as much as 30%. Our findings indicate widespread low level CP trafficking by U.S. computers in one peer-to-peer network, while a small percentage of computers made high contributions to the problem. However, our measures were not comprehensive and should be considered lower bounds estimates. Nonetheless, our findings show that data can be systematically gathered and analyzed to develop an empirical grasp of the scope and characteristics of CP trafficking on peer-to-peer networks. Such measurements can be used to combat the problem. Further, investigative software tools can be used strategically to help law enforcement prioritize investigations.

Joined the PETS 2014 TPC

Mon, 21 Oct 2013 12:00:00 +0000

I’ve joined the PETS 2014 TPC. The Privacy Enhancing Technologies Symposium is the premier venue for novel research on the theoretical and practical aspects of privacy technologies. Please submit your work!

If you have interesting work-in-progress, consider submitting to the associated workshop HotPETs.

Efficient Tagging of Remote Peers During Child Pornography Investigations

Mon, 07 Oct 2013 12:00:00 +0000

My paper Efficient Tagging of Remote Peers During Child Pornography Investigations, written in collaboration with Brian Levine, Clay Shields, and Brian Lynn, has been accepted to the IEEE Transactions on Dependable and Secure Computing.

In it, we examine the problems inherent in using various network- and application-level identifiers in the context of forensic measurement, as exemplified in the policing of peer-to-peer file sharing networks for sexually exploitative imagery of children. We present a one-year measurement performed in the law enforcement context. We propose a tagging method marks that remote machines by providing them with application- or system-level data that is valid, but which covertly has meaning to investigators. This tagging allows investigators to link network observations with physical evidence in a legal, forensically strong, and valid manner.

Turning Off GPS is Not Enough: Cellular location leaks over the Internet

Sat, 13 Jul 2013 00:00:00 +0000

Announcing mallet-LDA

Tue, 25 Jun 2013 14:00:00 +0000

mallet-lda is a thin Clojure wrapper around MALLET’s LDA topic modeling implementation. I’ve been using it for some time on an private project. While it definitely is still rough around the edges, I’m pushing it to GitHub in case someone else finds it useful.

If I add anything useful to it (like a more idiomatic interface) I’ll push those changes.

Patches and bug reports are welcome. Please use the GitHub issue tracker and/or send me a pull request.

WWW 2013 Best Paper Nomination

Wed, 15 May 2013 17:00:00 +0000

My paper Measurement and Analysis of Child Pornography Trafficking on P2P Networks, written in collaboration with other members of the Center for Forensics, was been nominated for Best Paper at the International World Wide Web Conference. It was one of only three papers so honored, out of 122 accepted (and 831 submitted!) to the conference.

Update: We were the Runner-Up for Best Paper, beating out 120 other accepted papers.

Disabling GPS is Not Enough: Cellular location leaks over the Internet

Wed, 15 May 2013 12:00:00 +0000

My paper Disabling GPS is Not Enough: Cellular location leaks over the Internet, written in collaboration with Hamed Soroush, Keen Sung, Erik Learned-Miller, and Brian Levine, has been accepted for publication in the proceedings of the Privacy Enhancing Technologies Symposium.

In this paper, we show that, given a cell phone and a remote party communicating over the Internet through 3G, the remote party can determine locational information without explicit GPS data. Specifically, we show that the path a cell phone and its owner take from or to a known location can be determined from remote observations of changes in TCP throughput. This determination is made possible by the relative ease of acquiring training data, given our attacker model (a streaming media service, or its data as subpoenaed by an investigator).

Measurement and Analysis of Child Pornography Trafficking on P2P Networks (Runner-Up, Best Paper Award)

Wed, 01 May 2013 00:00:00 +0000

Our Work Mentioned in the Boston Globe Magazine

Sat, 20 Apr 2013 20:00:00 +0000

This week’s Boston Globe Magazine has a story on innovations developed at UMass. Among mentions of the “hockey stick” global temperature graph, an electricity generating microbe and Craisins, our work here at the Center for Forensics gets a mention.

One Man's PET is Another Man's Security Vulnerability

Thu, 14 Mar 2013 14:35:00 +0000

While reviewing for PETS this year, a thought struck me. Many privacy-enhancing technologies are, from some perspective, security vulnerabilities.

In the U.S., we have very little in the way of legal protection when it comes to personal information, and privacy-enhancing technologies can be used by savvy users to protect themselves.

Systems that are designed to prevent user and usage tracking (e.g., Tor, TrackMeNot, NoTrace) often do so by breaking a property of the system they interface with. In particular, many web sites and services implicitly or explicitly expect to be able to tie user sessions together, and to track users across sites and visits. The information a user provides the server is half of a transaction (the other half being the service provided to the user). Further, in some cases, sites’ terms of service or terms of use forbid attempts to circumvent this tracking.

Viewed from the perspective of the web service provider, privacy-enhancing technologies are exploiting a security flaw. Users should have to reveal information to receive service; privacy enhancing technologies are an attack on a vulnerability, breaking the integrity of the transaction.

In a better world, we would also use laws and policies to protect users’s privacy, especially as people (and researchers) claim their privacy is quite important to them.

Measurement and Analysis of Child Pornography Trafficking on P2P Networks

Fri, 08 Feb 2013 09:00:00 +0000

My paper Measurement and Analysis of Child Pornography Trafficking on P2P Networks, written in collaboration with other members of the Center for Forensics, has been accepted for publication in the proceedings of the International World Wide Web Conference.

In it, we examine a large data set collected over a year on both the Gnutella and eMule/eDonkey networks. We examine methods of target selection designed to reduce content availability (an NP-hard problem); and we discover an empirical justification for focusing on subgroups of peers that are the most aggressive, in terms of their duration and scope of activity, volume of shared content, or attempts to escape attribution.

We also find that users trafficking in child sexual abuse imagery on these networks who use Tor use it inconsistently. Over 60% of linkable user sessions send traffic from non-Tor IPs at least once after first using Tor, thus removing its protection; over 90% of sessions observed on three or more days fail likewise. These sessions are linkable by the remote host because at the application level, some protocols send consistent identifiers. This problem is well documented.

Moving from Noir to Compojure and lib-noir

Wed, 06 Feb 2013 10:00:00 +0000

I have a small web application I wrote a while back, using the Noir framework. As pointed out on the clj-noir group by Anthony Grimes, Noir’s maintainer, Noir is now deprecated. So I spent an hour or two doing the most trivial possible translation of my application from Noir to a Compojure + lib-noir based web stack. I’m documenting the process here in case someone else finds it helpful.

Updating `project.clj`

First, I made the following changes to myproject.clj file. I modified :dependencies as follows:

Removed [noir "1.0.3-beta3"]
Added [lib-noir "0.3.5"] and [compojure "1.1.5"]
Added [ring-server "0.2.7"] (to assist in starting the server, since Noir used to do this for me)

I then added [lein-ring "0.8.2"] to my :plugins key, which adds common Ring tasks to Leiningen, such as running a development server with a simple lein ring server. This necessitated the addition of a :ring key:

:ring {:handler myproject/app}

containing a map that points to the Ring handler defining my application – more about this handler in a bit. There are some other useful things you can stick in the :ring key’s map; check out the lein-ring documentation for details.

I added some additional configuration information to my :profiles, which you can read more about in the Ring documentation.

{:production {:ring {:open-browser? false
                       :stacktraces? false
                       :auto-reload? false}}
   :dev {:dependencies [[ring-mock "0.1.3"]
                        [ring/ring-devel "1.1.8"]]}}

I also added :min-lein-version "2.0.0" to the project map.

I previously had added Hiccup to my dependencies; you will need to do so, too, if you haven’t already, if you’re following this document as a guide.

Converting `server.clj`

If you used lein new noir and/or followed the Noir tutorial, you likely have a server.clj file kicking around that used to be responsible for starting the web server and adding what Noir calls views to it. For my quick-and-dirty conversion, I chose to place my Compojure routes in this file, and to define the Ring handler there.

First, I removed noir.server from my (ns)form’s :require. I removed the -main function, as I am now going to use lein ring and related functionality to start the web server. I added [compojure.route :as route] and [noir.util.middleware :as nm] to my :require, for reasons that will become clear momentarily.

I created a var, app-routes to hold the sequence of routes that my application would handle, and initialized it with a simple catch-all to handle 404s:

(def app-routes
  [(route/not-found "Not Found")])

I also defined app as the Ring handler, using lib-noir’s noir.util.middleware/app-handler, which takes a sequence of routes and returns a handler wrapped in all of Noir’s default middleware. I discovered the hard way if you don’t do this or some variant of it, many of Noir’s functions, such as validation, don’t work. Duh!

(def app
  (nm/app-handler app-routes))

If you’d already converted to using lein-ring, as suggested by http://www.webnoir.org/tutorials/others/, you may not need to do some or all of these steps.

Converting the Views

Again, if you used lein new noir and/or the tutorial, your pages are defined by defpartials and defpages in files in the views/ directory.

In each such file, I removed noir.core from its (ns) form.

I handled defpartial by essentially macro-expanding it. defpartial is a convenience macro that returns a function that returns Hiccup-style HTML. I replaced it with a plain old defn that wraps its contents in (hiccup.core/html).

defpage is a slightly stickier wicket. It’s a stateful abstraction that chooses One Way to define routes and return functions that render html; as such, it’s very simple. If you’re defining very static, straightforward routes, it’s much less verbose than how I chose to unpack it. Nevertheless, here’s what I did:

I replaced each defpage with a defn, where the function name was chosen to correspond to the URI. For example, (defpage "/" [] ... became (defn index-page [] ....
I added a route to app-routes (above) to reflect this route, e.g.,: (GET "/" [] (the-relevant-view/index-page)) (where the-relevant-view is the namespace the newly-defined index-page function lives in).
For defpages that used the {:as params} style of destructuring to get the parameter map (as suggested in the Noir forms tutorial), I converted (defpage [:post "/user/add"] {:as user} ... to something line (defn user-add [user] ...) with a (POST "/user/add" [:as {user :params}] (the-relevant-view/user-add user)) route.
Finally, any uses of (render) were replaced with a direct call to the correct function to render that page.

Once this all was done, I could lein ring server and things just worked.

Overtone and ClojureScript, Updated

Fri, 01 Feb 2013 21:00:00 +0000

Last night I was fooling around with ClojureScript, running through examples floating around on the web. I thought Chris Granger’s post on Overtone and ClojureScript looked neat, so I pulled the project from GitHub and tried to lein run it.

Alas, it failed, for several reasons. So I updated it to build correctly, and I’m posting what I did in case someone else finds it useful. My updated version of OvertoneCljs is on GitHub.

Getting Things Working

The first problem I hit when trying to lein run the project was Overtone failing to download piano samples. The old version of Overtone referenced in the project.clj file had a hardcoded URL to the samples that was no longer live. I updated project.clj to use a newer version of Overtone and solved that problem:

[overtone "0.8.1"]

but created another. The API of Overtone changed between 0.6.0 and 0.8.1. In particular, the pink-noise unit-generator no longer takes arguments, so the Clojure compiler choked:

Exception in thread "main" java.lang.IllegalArgumentException: Error in checker for ugen ==> pink-noise
You supplied too many arguments. 
Supplied args: ([1 1])
Expected arg keys: ()

I modified the relevant line (src/overtoneinterface/models/dubstep.clj:20) and removed the arguments to pink-noise to fix the problem. lein run then got the server running and working.

Getting Things Stable

When Chris first whipped up this project, many of its dependencies were in a state of flux. Stable builds depend upon repeatability. In Clojure projects, repeatability is typically handled by specifying libraries with semantic versions, and making sure these libraries are posted somewhere public, like the Maven Central Repository or Clojars. -SNAPSHOT versions break this rule and can result in build problems appearing over time.

Looking at project.clj, several library versions are snapshots:

[jayq "0.1.0-SNAPSHOT"] 
[crate "0.1.0-SNAPSHOT"]
[fetch "0.1.0-SNAPSHOT"]

I updated the first two to their latest stable versions:

[jayq "2.0.0"]
[crate "0.2.4"]

When I updated fetch, it pulled in an older version of noir, which was easy enough to exclude:

[fetch "0.1.0-alpha2" :exclusions [noir]]

You can use lein deps :tree to see recursive dependencies, and the lein-pedantic plugin to look for common pitfalls related to incompatible dependencies. The final version of my project.clj has a couple of other tweaks recommended by lein-pedantic.

Since jayq, fetch, and crate are ClojureScript libraries that are used in the ClojureScript source that Chris wrote, I needed to recompile that ClojureScript to make sure everything was OK. I added:

[lein-cljsbuild "0.3.0"]

to my plugin list (which you can do in project.clj or globally in ~/.lein/profiles.clj; I chose the former for repeatability reasons). Running lein cljsbuild once informed me the build configuration was out of date; I updated the :cljsbuild key in project.clj to use the new format:

:cljsbuild {:builds [{:source-paths ["src"],
                      :builds nil,
                      :compiler {:pretty-print true,
                                 :output-dir "resources/public/cljs/",
                                 :output-to "resources/public/cljs/bootstrap.js",
                                 :optimizations :simple}}]}

I also updated the required version of Clojure to 1.4.0 (as the current ClojureScript compiler requires it):

[org.clojure/clojure "1.4.0"]

lein cljsbuild once then started, but had problems when it entered non-ClojureScript directories. Since Chris wrote this example, the ClojureScript toolchain has evolved to (I think) expect Clojure and ClojureScript to be kept in separate hierarchies, so I moved main.js from src/overtoneinterface/client to src-cljs/overtoneinterface/client. I also changed :source-paths to the ClojureScript directory ["src-cljs"] as part of this move.

Then it was down to problems introduced by the newer versions of dependencies. crate’s crate.macro namespace is now crate.def-macros; updating src-cljs/overtoneinterface/client/main.cljs to reflect this change allowed compilation to succeed. Similarly, I needed to account for the rename of hiccup.page-helpers to hiccup.page in the newer version of hiccup pulled in by the new version of noir. Finally, I explicitly passed nil as the last parameter in the remote-callback to quiet a compiler warning; the remote being called triggers the audio playback, but it doesn’t care about any callback (hence the nil). I’m not sure if Chris modified the API at some point, or just didn’t worry about the warning when he wrote this code.

There are still some warnings being emitted by the ClojureScript compiler. They are related to clj->js being redefined. Since Chris wrote his example, an equivalent function was introduced into the ClojureScript runtime. Barring an update to fetch, there’s no way to fix this warning (jayq version 2.0.0 fixes this problem in that library), and no harm done by ignoring it.

TODO or not TODO

There’s lots more that could be done: noir is deprecated, so you could replace it with Compojure and lib-noir. fetch never left alpha, and there are almost certainly better alternatives available now (like shoreleave-remote). I’m not sure that the community has standardized on one yet, though. Feel free to fork!

Our Work Mentioned in New York Times Magazine

Thu, 24 Jan 2013 16:43:00 +0000

This week’s New York Times Magazine’s cover story “The Price of a Stolen Childhood,” by Emily Bazelon, describes aspects of the trafficking of child sexual abuse imagery on the Internet, and its terrible consequences for victims. The piece mentions that investigators use a tool we developed here at the Center for Forensics.

Whiteboard Diagrams as PDFs

Mon, 21 Jan 2013 05:31:00 +0000

Need a quick diagram for the paper you’re working on? Instead of this:

\begin{figure}
\vspace{0.5in}
Remember to put a diagram here!
\vspace{0.5in}
\caption{The to-be-written awesome caption will go here.}
\label{fig:now-its-all-clear}
\end{figure}

what if you could quickly turn a whiteboard sketch into a diagram suitable for use as a draft — and maybe even for use in a camera-ready, depending upon your drawing skills — in your paper?

I find drafting diagrams on the whiteboard is much faster than trying to do it in PowerPoint, OmniGraffle, or the like. Dan Roam’s non-technical but useful book The Back of the Napkin might help convince you of this, if you aren’t too averse to what I think of as business-targeted self-help books. Randall Munroe’s “what if?” posts are an excellent showcase for the explanatory power of simple line drawings. Who knows? You might like your hand-drawn diagram so much that you use it as-is, and don’t end up recreating it in Powerpoint.

But then how do you get it into a nice vector format for use in LaTeX or the like? Pull out your smartphone, take a picture of the whiteboard, and put it on your computer. You can use various programs to make this easier, like the Camera Upload feature in Dropbox’s phone app.

Smartphones usually produce JPEGs, which aren’t the ideal image format for diagrams, particularly diagrams that should have the feel of vector, rather than raster, graphics. I use several open source tools to quickly convert a JPEG like this:

into a small, scalable vector diagram like this:

It’s a multi-step process. First I crop and threshold the image into a bitmap using Gimp, and then I vectorize it using potrace. Specifically:

Crop, threshold, and make a bitmap:
- Load the JPEG in Gimp.
- Select the area you want to crop.
- Crop using Image → Crop to Selection.
- Convert to a bitmap using Image → Mode → Indexed.
- (Optional) Scale the image using Image → Scale Image... to about 1,000 pixels or so in the shorter dimension, preserving the aspect ratio. This step isn’t necessary, but might help potrace if you have a particularly high-resolution camera on your phone.
- I get best results if I use Generate optimum palette with two colors, rather than using Use black and white (1-bit) palette. You’d think they’d be identical, but in my very limited testing, they’re not. Your results may vary.
- Export to a bitmap format that potrace can understand. Use File → Export..., and save as a PBM.
Use potrace to convert from a bitmap to a vector format:
- To make a PDF, try potrace -b pdf -o file.pdf -t 10 file.pbm. You may want to play with the potrace algorithm’s options (see the man page); the -t n option suppresses speckles of up to n pixels, which I find useful in removing stray whiteboard marks; calibrate n to the size of the image and the dirtiness of your whiteboard.
- You can use -b svg to create SVG files, which can be rendered by most web browers. That’s where the preceding image came from.

There are many ways to tweak this process. Use ImageMagick or GraphicsMagick instead of Gimp if you want to do it all at the command line, or try Inkscape’s integrated potrace functionality if you want to do it all in a GUI.

Happy drawing!

The Commonwealth Center for Forensics Is Not a State Crime Lab

Sun, 20 Jan 2013 10:41:00 +0000

I’ve received several phone calls in the last hour about “breaking news related to a chemist at the Amherst state crime lab facing criminal charges.”

The Commonwealth Center for Forensics is not a state crime lab. It is a research center where we work on digital forensics and privacy. We have no contact with, knowledge of, or comment on the chemist in question.

If you’re a reporter looking for information, please don’t call me, as I can’t help you.

Miscellaneous LaTeX/BibTeX Tools

Sat, 19 Jan 2013 16:05:00 +0000

There are many minor utilities that make my life easier when I’m preparing manuscripts in LaTeX. Among them:

latexpand is a Perl script that can perform various pre-submission tasks. I frequently use it to expand \input and \include directives, and to remove comments.
latexdiff performs a LaTex-aware diff on the text of LaTeX source, resulting in a file you can run through pdflatex. The differences are clearly marked in the resulting PDF. Further, latexdiff understands some version control systems, notably Subversion and Git, so it makes it easy to show where the text of a manuscript has changed compared to previous versions. You do keep your paper sources in version control, right?
bibtool is a swiss army knife for BibTeX files. I use it for all sorts of things, most commonly to extract from a master .bib file the list of just the entries used in the current document, for example: bibtool -x paper.aux.
dwdiff is a word-level diff tool. It can take as input the output of other diff programs using the --diff-input option; this comes in handy when using svn diff to see source changes. Git has built-in word-level diffs, using the --word-diff (or related --color-words) option to git diff.

Octopress: Great Static Web Site Generator, or the Greatest?

Fri, 18 Jan 2013 17:00:00 +0000

I’ve switched over to the so far excellent Octopress. Previously I used a lightly customized Jekyll setup based on Fletcher Penney’s Multimarkdown CMS. Time for a change!

Joined the DFRWS 2013 TPC

Wed, 19 Dec 2012 12:00:00 +0000

I’ve joined the DFRWS 2013 TPC. DFRWS is the leading digital forensics research conference. If you’re doing work in the field on one of the many topics of interest (as described in the CFP), please submit a writeup! The submission deadline is February 20th, 2013.

Effectiveness and Detection of Denial-of-Service Attacks in Tor

Thu, 15 Nov 2012 12:00:00 +0000

After an extended review process, my paper Effectiveness and Detection of Denial-of-Service Attacks in Tor, written in collaboration with Norman Danner and Danny Krizanc at Wesleyan, and a very dedicated, very talented undergraduate, Sam DeFabbia-Kane, has been published in the ACM Transactions on Information and System Security.

This manuscript is a much extended and improved version of the paper we published at Financial Cryptography 2009. In it, we examine the denial-of-service attack that Borisov et al. previously proposed, both through analysis and simulation. We also describe two algorithms for detecting such attacks, one deterministic and proved correct, the other probabilistic and verified in simulation.

Effectiveness and Detection of Denial-of-Service Attacks in Tor

Thu, 01 Nov 2012 00:00:00 +0000

Joined the PETS 2013 TPC

Wed, 29 Aug 2012 12:00:00 +0000

I’ve joined the PETS 2013 TPC. The Privacy Enhancing Technologies Symposium is the premiere venue for novel research on the theoretical and practical aspects of privacy technologies. The CFP lists suggested topics; please submit your work! Abstracts are due February 15th, 2013, and full papers four days later.

If you have interesting work-in-progress, consider submitting to the associated workshop HotPETs, which has a submission deadline of April 15th, 2013.

Forensic Investigation of the OneSwarm Anonymous Filesharing System

Mon, 17 Oct 2011 12:00:00 +0000

My paper Forensic Investigation of the OneSwarm Anonymous Filesharing System, written in collaboration with Swagatika Prusty and Brian Neil Levine, has been published in the ACM Conference on Computer and Communications Security (CCS 2011). In it:

We show a weaknesses of the OneSwarm system to a practical, statistical timing attack, allowing attackers to determine if a peer is the source of a file.
We correct the original analysis of the system’s robustness against collusion attacks and show it is less resistant than previously believed.
We show that an application of a known TCP-based attack can determine a peer is the source of a file, if that peer has disabled rate-limiting in their client.

Forensic Investigation of the OneSwarm Anonymous Filesharing System

Sat, 01 Oct 2011 00:00:00 +0000

Effective Digital Forensics Research is Investigator-Centric

Tue, 09 Aug 2011 12:00:00 +0000

My position paper Effective Digital Forensics Research is Investigator-Centric, written in collaboration with Robert Walls, Brian Levine, and Clay Shields, has been published in the USENIX Workshop on Hot Topics in Security (HotSec 2011). In it, we point out the sharp differences of digital forensics research to computer security research, in the hopes of aiding both reviewers and researchers in their goal of producing and publishing useful, effective digital forensics research.

Effective Digital Forensics Research is Investigator-Centric

Mon, 01 Aug 2011 00:00:00 +0000

Empirical Tests of Anonymous Voice Over IP

Sat, 01 Jan 2011 00:00:00 +0000

Strengthening Forensic Investigations of Child Pornography on P2P Networks

Mon, 01 Nov 2010 00:00:00 +0000

Forensic Investigation of Peer-to-Peer File Sharing Networks

Sun, 01 Aug 2010 00:00:00 +0000

DEX: Digital Evidence Provenance Supporting Reproducibility and Comparison

Sat, 01 Aug 2009 00:00:00 +0000

Detecting Denial of Service Attacks in Tor

Sun, 22 Feb 2009 00:00:00 +0000

Cheat-Proof Playout for Centralized and Peer-to-Peer Gaming

Thu, 01 Feb 2007 00:00:00 +0000

Maximizing Transfer Opportunities in Bluetooth DTNs

Fri, 01 Dec 2006 00:00:00 +0000

Inferring the Source of Encrypted HTTP Connections

Sun, 01 Oct 2006 00:00:00 +0000

Privacy Vulnerabilities in Encrypted HTTP Streams

Sun, 01 May 2005 00:00:00 +0000

Marc Liberatore

Don't make me tap the sign

Received the Faculty Distinguished Teaching Award

Not admitting graduate students or hiring assistants/staff in AY25-26

Using Thunderbird (SMTP/IMAP) with Microsoft Exchange 365 and Modern Authentication at UMass Amherst

Statistical Detection of Downloaders in Freenet

Answers for Prospective Undergraduates

A Gentle Graphical Introduction to Recursion

Recursion and fractals

Getting started

Setting up processing

Drawing a tree

No recursion here

More levels

A Recursive tree

Some questions

An exercise

Other comments on recursion

Server-side traffic analysis reveals mobile location information over the Internet

College Outstanding Teacher Award

Forensic Identification of Anonymous Sources in OneSwarm

Statistical Detection of Downloaders in Freenet

Innovation with Scale

Innovation with Scale

Nominated for a Distinguished Teaching Award

COMPSCI 190D (Using Data Structures) and 365/590F (Digital Forensics)

COMPSCI 190D

COMPSCI 365/590F

COMPSCI 190D: Using Data Structures

COMPSCI 391L/591L: Computer Crime Law

Joining the CICS Faculty

Joined the PETS 2017 TPC

Characterization of Contact Offenders and Child Exploitation Material Trafficking on Five Peer-to-Peer Networks

CyberCorps® Scholarship for Service at UMass

Discovering Specification Violations in Networked Software Systems

Nominated for a Distinguished Teaching Award

COMPSCI 290NW: A Networked World

Discovering Specification Violations in Networked Software Systems

Sybil-Resistant Mixing for Bitcoin

CMPSCI 187: Programming with Data Structures

Joined the PETS 2015 TPC

More PETS news

Efficient Tagging of Remote Peers During Child Pornography Investigations

Sybil-Resistant Mixing for Bitcoin

Joined the DFRWS 2015 TPC

CMPSCI 383: Artificial Intelligence

Location Privacy without Carrier Cooperation

Location Privacy without Carrier Cooperation

CMPSCI 290NW: A Networked World

Measuring a year of child pornography trafficking by U.S. computers on a peer-to-peer network

CMPSCI 453: Computer Networking

Joined the DFRWS 2014 TPC

Measuring a year of child pornography trafficking by U.S. computers on a peer-to-peer network

Joined the PETS 2014 TPC

Efficient Tagging of Remote Peers During Child Pornography Investigations

Turning Off GPS is Not Enough: Cellular location leaks over the Internet

Announcing mallet-LDA

WWW 2013 Best Paper Nomination

Disabling GPS is Not Enough: Cellular location leaks over the Internet

Measurement and Analysis of Child Pornography Trafficking on P2P Networks (Runner-Up, Best Paper Award)

Our Work Mentioned in the Boston Globe Magazine

One Man's PET is Another Man's Security Vulnerability

Measurement and Analysis of Child Pornography Trafficking on P2P Networks

Moving from Noir to Compojure and lib-noir

Updating project.clj

Converting server.clj

Converting the Views

Overtone and ClojureScript, Updated

Getting Things Working

Getting Things Stable

TODO or not TODO

Our Work Mentioned in New York Times Magazine

Whiteboard Diagrams as PDFs

The Commonwealth Center for Forensics Is Not a State Crime Lab

Miscellaneous LaTeX/BibTeX Tools

Octopress: Great Static Web Site Generator, or the Greatest?

Joined the DFRWS 2013 TPC

Effectiveness and Detection of Denial-of-Service Attacks in Tor

Effectiveness and Detection of Denial-of-Service Attacks in Tor

Joined the PETS 2013 TPC

A Recursive `tree`

Updating `project.clj`

Converting `server.clj`