First of all, we need to precisely define “sampling”. How much state of the program do we see? The entire heap? The PC? The stack? The current value of all registers? How do the properties covered improve or degrade as we increase or decrease the state covered?

Then — what is the granularity of sampling? Instructions? Basic blocks? Random points in the program?
Also, sampling can not enforce a property with certainty, but with some probability. How can we make this probability high?

Like I said, this is just a fuzzy notion, and I have no concrete answers. For all I know, it might turn out that the class of properties enforceable through sampling is very small, or very weak. But it would be nice to know anyway.

LaTeX UCI thesis class and sample LaTeX file (ZIP file)

Credits: I initally got this template from TeX guru and ex-officemate Jeff von Ronne. I’ve made a tweak or two, but it’s 99% Jeff’s work (and lots of people before him too — see the class file for more credits).

O Google, please make this the first hit for the next poor grad student who searches for “uc irvine dissertation template”!!

Ben says: what if Riya recognizes and tags pictures of me in public that other people have taken, that I don’t necessarily want to be associated with? He uses the example of visiting an erotica event.

To which Munjal, one of Riya’s founders, replies:

Riya doesn’t look for you or tag you in another’s photo unless they train us and have you in their friends list. Even if they do, it is not public unless they make it public.

I think that’s a fair enough reply.

I am not a  lawyer, but my perspective on this: when you’re in public (on the street, at an erotica expo etc) you don’t really have any reasonable expectation of privacy, so you can’t say “my privacy was violated” if someone recognizes you.

My only concern about Riya doesn’t even have anything to do with facial recognition — it’s just that (to me, at least) my photos are rather personal things, and I do feel a little queasy about uploading all of them to a server that I don’t control. But this is pattern that comes up again and again, with any hosted service — Gmail, online calendaring, online file storage etc. If only there was a way for me to encrypt everything with a key that I own, and then upload everything, that would be great. But in general, this is a hard problem — how is the remote service going to work on your data if its encrypted?

The uploading tool not only transfers the photos to Riya, but also performs the actual recognition of faces. When the pictures are uploaded, you can log into the web site and start attaching names to recognized faces. Once you give it 20-30 samples of a specific person, it does a pretty good job of recognizing more pictures of the same person — at least for frontal shots. Later, you can go pick out the pictures it recognized incorrectly.

Another nice touch — it does OCR on text in pictures. But this seems to work only with more or less horizontal text, and with fonts that are common.

I never thought I’d use an online service for storing all my pictures because I just love having them locally, to browse whenever I like. But this is compelling enough that I think I’m going to start slowly uploading all my pictures to Riya.

Number one wish for Riya: have a local client that allows offline browsing of your photo collection, with facial recognition. Or better still, standardize a format for specifying regions within a picture, and metadata associated with it (e.g. the rectangle from (x1, y1) to (x2, y2) has Vivek’s face), so that multiple clients can use it. Not sure how well that’s going to work with their business model, though.

Overall, I think this has the potential to be something really great!

Here’s my dissertation. (PDF, 3.5 MB)

To cut a long story short, here is my thesis:

Remote attestation, one of the core mechanisms of Trusted Computing, can be
performed in a way that:

• reasons expressively about program behavior and dynamic properties
• enables a flexible, graded notion of trust
• avoids intractable management problems at both the client and server end
• does not tie attestation to a specific executable binary

In short, remote attestation can attest program properties, rather than program
binaries. I call this semantic remote attestation.

Andrew Tannenbaum’s group has just published a paper that shows how seemingly innocent RFIDs can be used to inject malicious code into the backends that process their data:

One day a container arrives in the supermarket distribution center that is carrying a surprising payload. The container’s RFID tag is infected with a computer virus. This particular RFID virus uses SQL injection to attack the backend RFID middleware systems.

There you go — another channel for tainted input.
This so-called “taint problem” comes up everywhere. Most recently, its been brought to light because of its implications for web application security, but if you dig deeper, its a much more fundamental problem that comes up whenever your program deals with untrusted input.

I think the long-term solution to this is to have fine-grained labeling of data, along with a way to propagate those labels. We’ve made an initial jab at the problem, but that’s only scratching the surface. How long before labeling becomes a first-class abstraction in a language? In a virtual machine runtime? Or even at the architecture level in hardware?

• feed ratings help when you have to quickly scan though a hundred feeds
• the little activity indicators next to each feed are a really good visual indication of which feeds have new stories
• you can sync your feeds up to a server (need to sign up for that) and then sync them across all your clients
• its in cross-platform Java

All the same, there’s still plenty more I want in a newsreader. My number one gripe: newsreaders have to effectively summarise and present information from a large number of feeds. All current newsreaders work on the “feed-browsing” model, where the user clicks on a feed, reads its stories, moves on to a different feed and so on. I want my newsreader to be a statistical clustering engine that automatically learns from my reading habits, and also clusters similar stories from across different feeds into a coherent view. In short, a newsreader has to make it easy for me to keep up with hundreds of feeds without having to scan each one of them.

Then Shop Finder is for you. Enter two or more shops, or restaurants or any business at all, and a location, and it will go and tell you where you can find all of them close to each other.

This is a quick and dirty early release, and there’s still plenty of stuff I want to do with this if I have some spare time on my hands:

• Brush up the interface — show links to the shops, present clusters in a way that doesn’t look like debug output etc.
• Let the user tweak the cluster radius — that’s how close two shops should be to be considered as part of the same cluster.

In the meanwhile, I hope someone finds this useful. Feedback is most welcome. Leave comments here, or email vh@vivekhaldar.com
This is what I was getting at with a couple of earlier posts.

OK, take me to Shop Finder already!!