Comics Recap

Five week month – June see?  Five Wednesdays.  Comics are on a four week schedule.  So for five week months they thin it out to five.  So the last week is a slack week.


I thought Stumptown was in, but I was wrong.  So I had nothing in my file.  I grabbed Northlanders.

Northlanders – A done in one tale of heroism and exploration on the high seas.  The vikings sail west to discover new land.  It is 670 – so no Canada yet.  But they make it to [spoilers].  (roll over to see nothing).  It was a pretty nifty tale.  But dark and violent and filled with greed and madness.  The art rocks with showy panoramas of volcanoes and man eating fish.  I recommend it – unless you actually want the heroism I talked about in the first line.  There might have been none of that.


IAM -Object Management – Part 3

Other user object management

So, we have nearly gotten to talking about access management (authorization), but first let’s look at some of the other user processes besides provisioning, deprovisioning and password management.


So we haven’t talked about how a directory works, but it is a hierarchical data structure.  Generally that structure is organized to support your corporate needs – by geographical location, or object function, or business unit, or administrative unit or other need.  A user object will only be at one place in your hierarchy (although links are possible).  This raises the possibility that when something changes the user must be moved.

Technically a move is easy.  But it has all the same potential complications as a deprovisioning.  Who approves it?  What happens to the data?  What links to other systems does the move impact?  It might be enough like a deprovisioning that your process might actually be to deprovision the user and have them provisioned again.  But, then you lose the continuity of the object.  If auditing the activities of the user for their whole stay in the directory is a requirement then either the object needs to stay consistent or a link needs to be made between the old and new objects.


The worst possible change.  If there is any business logic attached to the name then this can be difficult.  An easy directory architecture is to have all the name fields in a directory reflect one another.  The given and surname, the e-mail address, the directory common name, display names, the credential name or certificates might be issued by the name.  If you did not use MBUNs to link your IAM system with other systems then the name might also be a key field used for synchronization.

The IAM architect’s dream is to have the person’s name bear no relationship to any of those other fields.  In which case a rename might not be a large operation.  Good luck with that.  I’d try and fight to have the MBUNs and common name be unrelated.  If that works you can try for the credentials.

Regardless of how stand-alone the name is you still need to keep the spectre of renames in mind as you create your provisioning processes and every time you link you system to another and with every application that leverages your IAM system.

Even if you have all those separated you still need to keep renames in mind.  Will any of your MBUNs or credentials or common names ever need changing for any reason.  And business logic may still rest on the given name and surname.

And don’t forget approvals and logging and all the other usual subjects in your rename process.

Disabling the Account

Not a lockout and not a full deprovisioning just preventing the account from being allowed to use the IAM system.  This process should be pretty simple to implement by this point.  The same concerns for approval and logging apply.

The big question is “why?” – Why would you disable an account?  Perhaps it has gone inactive.  Perhaps it seems to have been under attack.  Perhaps it is a stage in executing another process.  Perhaps someone is going on leave.  Perhaps new accounts are initially placed into a disabled state until the person performs a verification of registration.

And once you know why the next question is “for how long?”  Disabled accounts are a security risk.  They can always be enabled and they are not under active use.  So a disable should eventually result in a user contact or a deprovisioning.

Every other data piece in the IAM system

They all might need changing or correcting.  A process needs to exist for each one – and you thought it would get easier.  They key question is will the change impact business logic?  If so, then you need to explore what the impact is and would your process need to consider it. If not, then it is simply approval and logging.

Other data may also have a need to keep versions of the old data, or privacy concerns.  Just take some time to look at every piece of data.

Examples of data common in an IAM system include: titles, phone numbers, addresses, e-mail/IM/other contact methods, organizational info (business unit, supervisor, etc.), identity proofing info, enrollment info.  We’ll consider roles, groups and other access information separately.

Also remember to create standardization or normalization constraints for each of your data fields.


I talking a lot about logging and auditing.  I’ve said that you need to log all your processes.  Specifically we can be thinking of two different places – automatically by the IAM system, in your change management sysem, or into fields of the IAM system.

More questions to ask?  Sure.

What do you want to audit?  all object changes, all authentications, all authorizations, access to individual systems?  What can your system log?  How will you collect the data?  How will you confirm its authenticity?  What detail do you need in the logs?

And more!  What are you planning on doing with these logs?  What audit requirements must you fulfill?  Are there legislative requirements?  Do you need to adhere to a standard like SOX (or a similar Canadian statute)?

Now how do you manage the log?  Where is it stored, does it need rotation?  Do you need to roll it up into summaries and reports?

Anything else?

Well – only everything you need to run any generic system.  Backup, restore, redundancy, performance and capacity monitoring, the role in DR and BCP.

We are getting so close to the end now!  One last piece of advice.  Things can also be overanalyzed.  Keep your system in perspective with what it is protecting.

MD and Me

So it may have escaped you notice, but I have a form of muscular dystrophy called facioscapulohumeral MD (FSH).

FSH – what I know

So this should be short.  I know very little.  There is actually very little to know.

It is a progressive genetic neuromuscular disorder that targets various voluntary muscles.  Basically it makes them weaker.  When I tell kids what happens I say that it makes my muscles like an old persons while I’m still young. (Less helpful now that I’m an old person myself.)

As a genetic disorder it is on a dominant gene so it isn’t contagious except to offspring. 🙂  FSH is just one disease under the muscular dystrophy (MD) banner.  The most known disease is Duchenne’s which impact children and some others like myotonic which weaken the heart.  FSH does neither, but is probably the most common of the MDs.  Still it targets only 1 in about 20,000 people and since it runs in families running into it randomly in the populace is pretty unlikely.  In all there are about 9 or 10 MDs and many more similar neuromuscular disorders.

FSH is so named either because it makes it difficult to pronounce and spell or because those are the earliest muscles targeted by the disease.  So first some muscles in the face, then the shoulders and then the upper arms.  After that it moves to the extremities of the limbs (ankles and wrists) and then up the limbs back towards the core.  There is no ‘typical’ progression for the disease.  Some folks don’t progress very far down the chain and it is only an inconvenience.  Family history isn’t an indicator on how it will progress in relatives.  It is typical that it general becomes noticeable in the teenage years.

They have identified the genetic anomaly that causes it, but they only have SWAGs as to why.  There is no know treatment or cure and relatively little research being done (compared to the big, common, more fatal diseases).  Most effort is made on helping to live with the disease – occupational therapy, orthotics, etc.

Exercise does not seem to conclusively slow or speed up the disease.  So the common recommendation is that moderate exercise is good to maintain health and perhaps prolong the range of motion.

My Disease

Well if any progression could be called typical it is mine.  Right?  Earliest symptom was an inability to smile fully (don’t show my teeth) or whistle.  Then as a teen my shoulders started winging and it became hard to do pushups.  In college I started to fall because of weak ankles.  After university, I needed first an ankle brace, then a cane, and then two ankles braces and a walker to aid walking.  I had difficulty standing from prone, then climbing stairs and lately getting out of chairs.

It is non-typical in the following three ways.  There is no bilateral symmetry.  Some muscles on the left are stronger than on the right and vice versa.  That is weird.  My wrists are still fairly strong – so it skipped them.  And third there is a difference in strength between my flexors and extensors.  For instance my ankles are strong enough that I can stand on tip-toe lifting my entire weight.  But I can’t lift the balls of my feet off the ground.

It causes no other medical impacts so far.  In general I’m pretty healthy.  My biggest risk from the FSH is falling.  FSH has never been responsible for my missing work – although I have had kidney stones in the last couple years that are completely unrelated.

In theory the disease progresses in spurts, but I haven’t noticed that.  Instead what happens is that it gradually becomes difficult to do something.  So eventually I stop doing that.  Once I stop doing something it quickly changes to being unable to do that at all.

Impacts it does have on me

Well I guess I am disabled enough these days to rate a parking placard and a taxable deduction for disability.  Those are pretty nifty side effects.  And both the walker and ankle braces are pretty neat gear.

I worry about the following things (but not obsessively):

  • falling on ice and getting very cold before I can call for help
  • falling in the washroom/shower and being unable to get to the phone
  • falling and breaking something (see a trend?)
  • having my job options limited due to a general difficulty/inability to travel
  • and, most embarrassingly, being unable to make it home to my toilet (which is raised) – but which has never happened.

I don’t mind offers to help.  In fact, they are appreciated.  But I do like to do what I can for myself.  So I might ask to do it myself anyway.  I also don’t mind talking about FSH.  Very few people ever seem to ask which I always think it weird.  When walking I am pretty concerned with my balance so I often flinch when someone comes to close.   I don’t mind human contact at all, I’m just worried about falling.  I think that gets misread sometimes.

In general my experience is that people are very understanding.  The exceptions being the folks that steal the good parking spots and people with strollers.

My perspective is that there are many worse things.  I’m able to do all the stuff I love – I was never a jock anyway.  It is likely not a disease which will ever kill me.  So no pity or feeling sorry or worry is needed.  I am very thankful though for all the folks who have helped me either when I asked or when they offered.  My friends and co-workers especially have always been extra nifty.

I think that about covers it.  Any questions?

More Todd-like poll 1

Note: Group Diet and non-diet preferences under the same type.

Un-Todd-like Poll 1

So this is a very un-Todd-like question.  Hopefully my interest isn’t completely prurient.

Note: It is anonymous.  I cannot tell who votes for what.

Note: I’ve closed down the comments because I think it would quickly get very TMI.

Note:You can vote for multiple things.  I’m hoping folks see 3-5 things they think are important.  Or even everything.  But you can only vote once.

Note: Normally I don’t need this many notes.

Weekly Recap

Well – this will be short.

I was inspired to do very little this past week.  I mean little useful.  I finished several books, comics and a video game.  But I wrote few good blogs, comic reviews, etc.

There was almost no traction on the job hunt.  No good posted jobs.  But I do have one solid lead provided by Matt.  We’ll see how that turns out.   The studying was also slow.  I made some good progress on studying Enterprise Architecture stuff.   But I have a ton to learn.  Mostly I seemed to make notes on other areas to research.  The MS studying went really slow.

Highlights were twofold – I was tweated – or my blog was.  Consider my narcissism stroked.  The second was a very nice BBQ last night.

Next week – I have another day or two with Fujitsu.  But I need the schedule the next exam writing which means getting the confidence to write it.  Ooh, and the new China Mieville novel comes out next week.  Yay!  And I want to write something funny on the blog.  Not sure what.


Bad Superman Premise

So, I haven’t read it yet.  So I shouldn’t comment.  But I will anyway.

The Superman issue this week was Superman #700.  It is a three part anniversary issue, but most importantly it is the first part (a prologue) the the upcoming Superman run by JMS.  Unfortunately I think the run has already gone off the rails.

JMS (Joe Michael Straczynski) is a writer perhaps best known for creating Babylon 5 and for writing the recent Eastwood directed movie Changeling (two completely different things).  He is also a fairly prolific comic book writer and has had one or two series on the go for about the last ten years.

JMS is a writer whose work is always worth checking out in my opinion.  It is always interesting and professional and often very very good.  Some good work includes Rising Stars, his Thor run and his current run on the Brve and the Bold.  But he has also had stories that have really been head scratchers.  Most notably his Amazing Spider-Man run.  Now that run had some awesome artists and the stories were always entertaining, but as Spidey stories?  As part of a run of a serialized title with a long history?  Not my favorite.  (Note One More Day was corporately driven so I don’t blame him for that arc.)

His Superman run promises to contain similar weaknesses.  The main one being the premise is not a good in-continuity Superman premise.  In that context it is just awful.

What is the premise?  Basically it is twofold. One, that due to his recent absences in space he has lost touch with the people of earth.  Two, that he should be doing more to save the people of earth from common hardships such as cancer.  As a result he will spend the next year (13 issues) of the superman title WALKING America to better bond with and protect it citizens.

Lousy, lousy, lousy.


Problem #1 – You can’t actually have superheroes solve problems like cancer in serialized fiction.  The resulting story will either undercut the tragedy and nature of the disease (if they do solve it)  or it will render the character impotent (if they don’t).  The end of the story can almost have only those two endings.  The next writer will need to reverse either one in order to tell additional stories.  (For reference note the travesty of Superman 4: Quest for Peace – different issue, but a similar problem.)

Problem #2 – This is a Superboy story not a Superman story.  Superman has already accepted his limitations.   He has other responsibilities – his wife, his job, his role in the JLA, etc.  It can be done still with Superman, but it has to be more nuanced and less sledgehammer’ish.  And look, oddly enough a year ago this story was done in Supergirl!  There it was a coming of age tale about finding your limits and Superman was the voice of knowledge and reason.

Problem #3 – It just ignores some mammoth continuity that just wrapped up in which Superman’s son and friend were trapped in the Phantom Zone, a planet full of Kryptonians was completely wiped out by Luthor and Braniac and elements of the American government actively plotted to aid in that extermination.  Essentially a story that has been building for three years and which climaxed in the last three months.  The plot threads were all neatly tied up, but the emotional elements were not.

Problem #3 – Walking America is just a dumb way of playing this out.  If the problem is that he isn’t doing more then he shouldn’t be restricting himself to do less.  Walking America (or traveling it) is a good story for a character who epitomizes ‘the American Way’.  There is a lot of good story potential there.  But this is not a good setup for it.

Now my problems may be over reactions – I haven’t read the issue yet.  And JMS might have a plan that avoids all the pitfalls.  But when the premise alone raises so many red flags? Gah!

Gah I say.