I might be a masochist, I don’t know. Certainly I didn’t find it enjoyable to read this book, but at least I got to the end of it, unlike the previous one which I also found difficult to digest.
The book, Counting from Zero by Alan B. Johnson is one of the worst books I’ve read in a while, to be entirely honest. It’s another cyber-thriller, if we want to use this name, akin to Russinovich’s Zero Day (review) and Trojan Horse (review) which I read last year and found.. not so thrilling — but in comparison, they are masterpieces.
So the authors in both the Russinovich’s and Johnson’s cases are actually IT professionals; the former author works at Microsoft, the latter has been co-author of the ZRTP protocol for encrypting audio/video conversations. Those who had to deal with that and Zfone before are probably already facepalming. While Russinovich’s world is made up of nuclear plants running Windows on their control systems, and connecting it to Internet, Johnson’s a world that is.. possibly more messed up.
Let’s start with what I found obnoxious almost immediately: the affectations. The cover of the book already shows a Ø sign — while I’m not a typographer, and I didn’t feel like asking one of my many friends who are, it looks like a bold Bodoni or something similar. It’s not referring to the Scandinavian letter though, and that’s the sad news. In the whole text, the character zero (0) has been replaced with this (wrong) character. For a person who can get angry when he has to replace ò with o for broken systems to accept his name, this is irksome enough. The reasoning for this is declared in the second half of the book as all programmers write it this way to not mistake it for an ‘o’ vowel — bad news for the guy, I don’t know people who do that consistently.
Even if I’m writing a password where the letters and numbers can be mistaken – which is not common, as I usually use one or the other — my preferred note for zeros is a dot at the center. Why a dot and not the slash that the author so much like? It’s to not confuse it with the many similar symbols some of which are actually used in mathematics, where the zeros are common (and this is indeed something that my math teacher in high school convinced me of). Furthermore – as Wikipedia notes – the slashed zero’s slash does not go over the circle, for the same reason as me using the dot: it would be too easy to mistake for an empty set, or a diameter sign.
Once, the use of this fake slashed zero is cute, done as a sed replacement all over the book? Bleah.
It’s not the only affectation though, another one is that chapters have been numbered … in hexadecimal. And before somebody asks, no it was not 0x-prefixed, which would probably have made more sense. And finally, there are email quoted almost every chapter, and they have a “PGP” block at the end for the signature (even though it is left to intend that they are actually encrypted, and not just signed). I’m pretty sure that there is some meaning behind those blocks but I can’t be bothered searching. There are also a bunch of places where words are underlined like if they were hyperlinks — if they were, they were lost in translation on the Kindle Paperwhite (which I have bought last week after breaking my Keyboard), as they are not clickable.
Stylistically, the book stinks. I’m sorry, I know it’s not very polite to criticize something this harshly, but it really does. It reads like something I was trying to write in middle school: infodumps a-plenty – not only in computer stuff but even on motorbike details – and not in a long-winded, descriptive, “look how cool” kind of way, just in a paragraph of dumping info on the reader, most of which is really not important to the story – action driven, and repeating the subject, the protagonist’s name, every line – Mick did this. Mick did that. Mick went somewhere – and in general very few descriptions of environments, people, or anything at all.
But, style is an acquired skill. I didn’t like the first Harry Potter book, and I enjoyed the later ones. In Russinovich’s case, the style issues on the first book were solved on the second (even though the story went from so-so to bad). So let’s look into the story instead. It’s something already seen: unknowns find zero-days, you got the self-employed wizkid who gets to find a fix, and save the world. With nothing new to add there, two things remain to save a book: characters and, since this is a cyberthriller, a realistic approach to computers.
These should be actually the strong points of the book, standing to the Praise between ToC and Prologue — Vint Cerf describe it “credible and believable”, while Phil Zimmerman calls it a “believable cast of characters”. It sets the expectation high.
The main protagonist is your stereotypical nerd’s wet dream: young self-employed professional, full of money, with a crew of friends, flying around the world. This might actually be something Johnson feels he’s himself, given that his biography on both the book and Amazon points that he’s a “Million Miler” with American Airlines. Honestly, I don’t dream to travel that much — but you all know how I hate flying. Not only he’s a perfect security expert and bike rider, he’s also a terrific mechanic, a sailor, and so many more things. His only defect in the whole book? He only speaks English. I’m not kidding you, he doesn’t go as far as shouting at a woman in the whole book! Have you ever met a guy like that in a security or FLOSS conference? I certainly haven’t, including myself. Seriously, no defects… sigh… I like characters when they have defects because they need to compensate to become lovable.
Scratch the protagonist then. Given the continuous turmoil in the IT scene about sexism and the limited showcase of women in a positive light, you’d expect that somebody writing about IT might want to tip the scale a little bit in their favor — or at least that’s what I would do, and what I’d like to see. How many female characters are there in the book? The protagonist’s sister, and his niece her daughter; the protagonist’s “on-again, off-again”, a new woman joining the crew at the beginning of the book, and … spoiler … a one-off, one-chapter hacker that falls for one of the oldest tricks in the book (after being said to be brilliant — even though her solutions are said not to be elegant).
The on-and-off, who’s supposed to be one of the crew of security experts, is neither seen, nor said, doing anything useful at all in the story, beside helping out in the second chapter crisis where the protagonist and his friends save a conference by super-humanly cloning a whole battery of servers and routers in a few hours from scratch, dissect a zero-day vulnerability on a web server, fix it, and do an “anonymous commit” (whatever the heck that should be!). Did you say “stereotype!”, expecting the protagonist to be madly in love with his long-time friend? No, worse, she’s the one who wants him, but he’s just not there.
The newly-joining gal? Works for a company that would have otherwise been badmouthed at the conference, and has a completely platonic relationship with the protagonist all over the book. Her only task is to “push papers” from the protagonist to her company’s techs — Daryl from Russinovich’s books is more proactive, and if you read them, you know that’s a hard record to beat.
Family-wise … parents are dead sister is married with child. Said child, even if coming up many times during the book, is almost always called “Sam” — a play with a tomboysh girl? I’d say more like an interchangeable character, as it could easily have been a boy instead of a girl, for what the book’s concerned. The sister is, by the way, a librarian — this is only noted once, and the reason is to do yet another infodump on RFID.
If you want to know the kind of dump of infodumps this book is, the author goes on a limb to comment about “obsolete” measure units, including an explanation of what the nautical knots are modeled after, explains the origins of “reboot”, the meaning of “order of magnitude”, ranted about credit card companies “collecting databases of purchasing habits and data”, the fact that you use dig to run a “DNS trace”, the fact that Tube is the “unofficial name for London’s underground railway” (unofficial? TFL calls it Tube!), the fact that there is a congestion charge in London, the fact that Škoda is a Czech brand, and what the acronym RAM stands for!
If anything, the rest of the “crew” does even less than all these people, all the work is done by the protagonist… even though all the important pieces are given to him by others! Sigh.
Before closing the review (that you can guess is not positive at this point), let’s look at the tech side. Given the author is a colleague, and given the kind of praises coming from other people “in the scene”, you’d expect a very realistic approach, wouldn’t you? Well, the kind of paranoia that the protagonist is subject to (not accepting un-encrypted email, phone calls or video) is known to be rampant, although I found that this is often more common among wannabes than actual professionals.
But (and I did take notes, thanks to the Kindle), even accepting that in the fury of disconnecting a possibly infected or to-be-infected network from the Internet you can identify in a nanosecond which are the (multiple) cables to the internet and at the same time damaging them (without even damaging the connectors)… since when you need a “makeshift soldering iron to repair the broken Ethernet connector” ? If it was equipment-side, a soldering iron is not going to be enough; if it was the cable… WTF are you using a soldering iron for?!
Ah! At some point the protagonist is given by “an uncle in Australia” some “magnetic GPS trackers” to use against the bad guys. How the uncle could have guessed that he needed them is already a good question. The fact that the ones used toward the end are for no use at all, is something I don’t want to spend time on. My question is going to be do you call realistic a throwable magnetic bug that receive GPS signal on the underside of a car *and can be traced by a cellphone in real-time*?
Oh and of course, this is the world-famous, filthy-rich security expert who only has one password for every service and changes it every week. If somebody thinks this is a good idea, let me remember that this extends the surface on which you’re vulnerable to MITM or sniffing attacks on in an incredible way! And they even steal his private key, not once, but twice! It seems like he knows everything about PGP and encryption but not about the existence of SmartCards.
Even though the guy has an impressive collection of SIM cards and mobile phones that work all over the world, including in the middle of the Atlantic ocean. And when he buys a new phone, he can just download and compile the operating system. And we have to fight to get Android sources for our phones…
Okay the review is getting longer than I expected, so I’ll just note down that the guy “performed a disk wipe on the solid state storage” — and yes he’s referring to the 37-or-however-much-that-was wiping that was debunked by the paper’s author, as most people misinterpreted it altogether. And that is completely irrelevant to solid state storage (and most modern non-solid state storage as well!). Oh and he doesn’t buy off-the-shelf systems because they could have keyloggers or malware in them, but trusts computer parts bought at the first store he finds on his phone.
Of course he can find components for a laptop in a store, and just fit it in his custom CNC case without an issue. He can also fit a state-of-the-art days-long battery that he was given earlier, without a charger design! Brilliant, just brilliant. Nothing for a guy who “did a mental calculation of how much lighter it would be in a titanium case… and how much more expensive”. I don’t even know the current price of dollars, he can calculate the weight difference and price of a titanium case in his mind.
Last pieces before the bombshell: the guy ends up in the TSA’s No-fly List; they actually spell the full TSA name. Then he’s worried he can’t take a plane from London to Kiev. Message for somebody who spent too much time in the USA even though he’s Australian (the author): TSA’s competence stops at the US border! And, even in the situation where somebody left their passport in the side pocket of somebody else’s carry on bag (so fortunate, deus ex machina knows no borders!), you don’t have to find the same glasses he had on the photo… they let you change glasses from time to time. And if you do have to find them you don’t need to find real glasses, if they give you headaches.
Sorry, I know, these are nitpicks — there is much more in the book though. These are just the ones that had me wondering out loud why I was still reading the book. But the bombshell I referred above is the following dialogue line:
“Sir, he uses ZRTP encryption for all his calls, and strong encryption on all his messaging. We know who he communicates with but we haven’t been able to break any yet…”
Thanks, Randall! XKCD #538
I know the guy is a co-author of ZRTP. But…