Marcus Ranum may not have built my hotrod, but he did help me buy my sedan
When I was first getting started in network security (back in the late '90s), I attended a SANS conference where Marcus Ranum spoke about firewalls. Of all the things he talked about that day, the one that made the most lasting impression wasn't about firewalls themselves but about finding interesting events in your logs. He called it "artificial ignorance": since you don't know in advance what an interesting event might look like, by eliminating uninteresting log items (known false positives, informational entries about benign events, etc.), you inherently highlight the interesting ones as a result. This eventually informed the basic design I used in writing a security event management solution for our network perimeter devices (it was cool for 2000, albeit thoroughly needing retirement by 2004).
Fast forward to this spring, when I began looking to replace my '99 built-from-jets sedan with something a bit newer. I could quickly tell from checking the dealer ads on craigslist and cross-referencing them against carfax that there were going to be few, if any, good deals available: anything that was being sold close to Kelly Blue Book value -- and especially below -- was previously in a collision or otherwise had a troubled, potentially haunted history. That's where an ounce of artificial ignorance (and a kilo of Yahoo Pipes) came in handy.
I wound up creating a pipe that took craigslist search results as input and eliminated all ads matching regular expressions that were likely to be dealer ads. Were it a command-line regex, it would have looked something like this:
I eventually added a couple of other search terms that matched the dealer names that were most consistently posting the models I was interested in, tested and re-tested, and eventually wound up with a pipe I was happy with. Several days later, I had my new-to-me sedan. Now my biggest problem, besides the car having a manual transmission and my commute being in Chicago, is that I am no longer driving any car mentioned in I Will Rule Your World. I'll have to update the live version for the next show (7/30 with Steve Poltz).
Fast forward to this spring, when I began looking to replace my '99 built-from-jets sedan with something a bit newer. I could quickly tell from checking the dealer ads on craigslist and cross-referencing them against carfax that there were going to be few, if any, good deals available: anything that was being sold close to Kelly Blue Book value -- and especially below -- was previously in a collision or otherwise had a troubled, potentially haunted history. That's where an ounce of artificial ignorance (and a kilo of Yahoo Pipes) came in handy.
visit our website|internet sales|stock (\#|number)
I eventually added a couple of other search terms that matched the dealer names that were most consistently posting the models I was interested in, tested and re-tested, and eventually wound up with a pipe I was happy with. Several days later, I had my new-to-me sedan. Now my biggest problem, besides the car having a manual transmission and my commute being in Chicago, is that I am no longer driving any car mentioned in I Will Rule Your World. I'll have to update the live version for the next show (7/30 with Steve Poltz).

