Despite the best efforts of the security community, the details of a critical internet vulnerability discovered by Dan Kaminsky about six months ago have leaked. Hackers are racing to produce exploit code, and network operators who haven't already patched the hole are scrambling to catch up. The whole mess is a good illustration of the problems with researching and disclosing flaws like this.

The details of the vulnerability aren't important, but basically it's a form of DNS cache poisoning. The DNS system is what translates domain names people understand, like www.schneier.com, to IP addresses computers understand: 204.11.246.1. There is a whole family of vulnerabilities where the DNS system on your computer is fooled into thinking that the IP address for www.badsite.com is really the IP address for www.goodsite.com -- there's no way for you to tell the difference -- and that allows the criminals at www.badsite.com to trick you into doing all sorts of things, like giving up your bank account details. Kaminsky discovered a particularly nasty variant of this cache-poisoning attack.

Here's the way the timeline was supposed to work: Kaminsky discovered the vulnerability about six months ago, and quietly worked with vendors to patch it. (There's a fairly straightforward fix, although the implementation nuances are complicated.) Of course, this meant describing the vulnerability to them; why would companies like Microsoft and Cisco believe him otherwise? On July 8, he held a press conference to announce the vulnerability -- but not the details -- and reveal that a patch was available from a long list of vendors. We would all have a month to patch, and Kaminsky would release details of the vulnerability at the BlackHat conference early next month.

Of course, the details leaked. How isn't important; it could have leaked a zillion different ways. Too many people knew about it for it to remain secret. Others who knew the general idea were too smart not to speculate on the details. I'm kind of amazed the details remained secret for this long; undoubtedly it had leaked into the underground community before the public leak two days ago. So now everyone who back-burnered the problem is rushing to patch, while the hacker community is racing to produce working exploits.

What's the moral here? It's easy to condemn Kaminsky: If he had shut up about the problem, we wouldn't be in this mess. But that's just wrong. Kaminsky found the vulnerability by accident. There's no reason to believe he was the first one to find it, and it's ridiculous to believe he would be the last. Don't shoot the messenger. The problem is with the DNS protocol; it's insecure.

The real lesson is that the patch treadmill doesn't work, and it hasn't for years. This cycle of finding security holes and rushing to patch them before the bad guys exploit those vulnerabilities is expensive, inefficient and incomplete. We need to design security into our systems right from the beginning. We need assurance. We need security engineers involved in system design. This process won't prevent every vulnerability, but it's much more secure -- and cheaper -- than the patch treadmill we're all on now.

What a security engineer brings to the problem is a particular mindset. He thinks about systems from a security perspective. It's not that he discovers all possible attacks before the bad guys do; it's more that he anticipates potential types of attacks, and defends against them even if he doesn't know their details. I see this all the time in good cryptographic designs. It's over-engineering based on intuition, but if the security engineer has good intuition, it generally works.

Kaminsky's vulnerability is a perfect example of this. Years ago, cryptographer Daniel J. Bernstein looked at DNS security and decided that Source Port Randomization was a smart design choice. That's exactly the work-around being rolled out now following Kaminsky's discovery. Bernstein didn't discover Kaminsky's attack; instead, he saw a general class of attacks and realized that this enhancement could protect against them. Consequently, the DNS program he wrote in 2000, djbdns, doesn't need to be patched; it's already immune to Kaminsky's attack.

That's what a good design looks like. It's not just secure against known attacks; it's also secure against unknown attacks. We need more of this, not just on the internet but in voting machines, ID cards, transportation payment cards ... everywhere. Stop assuming that systems are secure unless demonstrated insecure; start assuming that systems are insecure unless designed securely.

---

Bruce Schneier is chief security technology officer of BT, and author of Beyond Fear: Thinking Sensibly About Security in an Uncertain World.

It's 10 am on a Thursday, and the line at Ritual Coffee Roasters in San Francisco snakes out the door. Inside, an espresso machine hisses like an angry tomcat as customers order their cappuccinos. But the real action is taking place a few steps away, where a scruffy barista stands at a stainless steel contraption, introducing the coffee he's about to serve to his rapt audience. "The Honduran is sweet," he says, "with a refined acidity and an excellent finish." He lets one perfectly measured scoop of fresh grounds shimmy deep into the machine, then goes to work, twiddling knobs, pushing buttons, and whirling a whisk in a chamber at the top of the silver box.

Forty-five seconds later, he sets down a single cup of custom-made coffee that's Jessica Alba hot, Bill Gates rich, and as unique as a snowflake. No foam. No caramel. No whip. Just beans and water — pushed through a cool little machine called the Clover — for a pricey $4 a pop.

The Clover coffeemaker debuted in a handful of cafés in 2006 and was promptly hailed as the best thing to happen to coffee lovers since the car cup holder. With an $11,000 asking price, the Clover has become a fetish object among the coffee-obsessed. Long queues signal its arrival in new cities, and self-described "Cloveristas" post videos on YouTube demonstrating the machine's flashy brewing process. There are more photos on Flickr paying homage to this shiny gadget (700 and counting) than actual Clovers in existence (roughly 250 worldwide).

The Clover also wowed Howard Schultz, founder and CEO of Starbucks. Last year, Schultz stumbled upon the machine in New York City when he had spotted a line of people standing outside a tiny joint called Café Grumpy. He tried a sample and declared it "the best cup of brewed coffee I have ever tasted." In March 2008, Starbucks announced the acquisition of the Coffee Equipment Company — the Seattle-based startup that manufactures Clovers in a converted trolley shed. His hope is that the Clover will bolster Starbucks' bottom line.

Chalk up some of the excitement — and the equipment's hefty price tag — to artisanal tech. A robotic hybrid of a French press and a Dirt Devil, the Clover is the first coffeemaker that lets the user program three key variables: dose, water temperature, and brew time. (Example: 37.5 grams of Brazilian Fazenda São João at 204 degrees for 43 seconds.) After the coffee steeps, a piston mechanism extracts the liquid from spent beans, resulting in a fresh cuppa in less than a minute. A filter platform pops a hockey puck of grounds out of the top, where it's easily wiped away. An Ethernet port connected to an online database is designed to let users save favorite recipes for specific beans. Made of stainless steel and copper, a single Clover typically takes several hours to assemble by hand. Fast, fancy, and idiot-proof? No surprise that Starbucks is all over the Clover — the company has been rolling them out since last summer. Half-caf nonfat toffee-nut latte lovers, get ready for a real cup of coffee.

I'm a coffee achiever, as that old ad campaign goes. I own two French presses, a stainless steel Cuisinart grinder/drip, a retro De'Longhi espresso machine, an Italian Vev Vigano moka pot, and a Vietnamese drip that I purchased in old Hanoi for making ca phe sua nong. My San Francisco neighborhood has five coffee shops within a five-block radius: four mom-and-pop operations and a Peet's. But compared with David Latourell, CEC's 42-year-old resident coffee expert, I'm a Sanka-slurping rube.

Latourell and I are standing in the middle of CEC's cupping room, a tasting area next to the company's small Seattle factory. The Clover is specifically designed to bring out the nuances of high-end coffees like Los Delirios, which comes from a Portland, Oregon, company called Stumptown Coffee Roasters. Los Delirios is a blend of Caturra, Typica, and Bourbon beans grown near Esteli, Nicaragua. Actually, it's on a micro lot located at 13° 22'45.99"N x 86° 28'50.45"W, between 1,050 and 1,450 meters above sea level, according to a manila "origin" card that comes with each bag of beans. Underneath the farm's GPS coordinates are flavor descriptions that read in part, "violets and black cherry, baking chocolate, and chocolate covered raisins."

Latourell hands me a cup of Los Delirios coffee made in the Clover. We both take slow, even sips. "I'm picking up a little chocolate," he says with a toss of his shoulder-length hair. I sip again, summoning every taste bud. I just taste — well, coffee. Delicious, sure, but coffee.

Like wine and, more recently, chocolate, a quality coffee bean must reflect a certain terroir — the climate, soil composition, and elevation of its place of origin. At least in theory, this gives a bean its unique and desirable flavor. Whether or not your average caffeine fiend can tell a Guatemalan Maragogype bean from a Honduran Catuai is debatable, but terroir explains how Stumptown can sell bags of beans for $40 a pound (about 10 times the price of commercial-grade coffee) and cafés can charge from $3 to $7 for a single cup of joe. "For $7, you can get a bad glass of wine," says CEC cofounder Randy Hulett. "Or you can get one of the best cups of coffee in the world."

Clover, From the Grounds Up

Clover looks like just another countertop coffee machine. But peek under the hood and you'll find an innovative brewing system. Here's how it works: 1. A barista selects dose, water temperature, and steep time. 2. A piston pulls down the filter platform while freshly ground coffee is poured into the chamber. 3. Hot water flows into the chamber. 4. The barista briskly stirs the grounds with a whisk, and the water and beans steep for several seconds. 5.The piston rises, creating a vacuum that separates the brew from the grounds, then lowers, forcing the joe out of a nozzle below. 6. The piston rises to the surface again, pushing up a disc of grounds, which are squeegeed away.

Then there's the top-shelf stuff. Stumptown sells beans from Nicaragua called Las Golondrinas for $80 a pound. On the international market, Esmeralda Special, a rare kind of Panamanian bean, can go for $130 a pound wholesale. And consider Kopi Luwak, also known as catshit coffee: It's an Indonesian bean that's eaten by a civet cat, then "harvested" from the animal's dung. (The bean's bitter flavor is apparently greatly improved by passing through a cat's digestive tract.) A single cup of Kopi Luwak at the Peter Jones espresso bar in London goes for $100, and a pound of the beans can cost as much as $600.

If you're going to pay that much for beans, of course, you want to have the right machine. Back in the cupping room, Latourell fires up the Clover and goes to work on a second cup of Los Delirios: He measures out 46 grams of beans, grinds them, and then slides them into the recessed chamber on top. Next, he programs a new brew time and temperature, raising the heat from 205 degrees to 207 and increasing the brewing time from 45 seconds to 50. As the hot water rushes into the chamber from a topside nozzle, Latourell stirs the blend with a metal whisk, being careful not to break the stream, which would cool the water. "The temperature has a massive effect on the extraction of chemicals that affect flavor," he explains.

I take a swig. Bang, there it is: chocolate. Scharffen Berger, eat your heart out! A few tweaks and I have a new beverage. And it's not just the chocolate flavor; the mouthfeel and acidity are completely different from the first cup. All Latourell did was adjust the brew time and temperature and add 6 grams of beans. Taste-testing it against the earlier brew, I wouldn't have guessed they were the same bean. I'm starting to become a Clover convert.

Brewed coffee is awful.That's what Zander Nosler thought back in 2001, when he was developing a commercial coffeemaker for — of all places — Starbucks. The bespectacled, rail-thin product designer had previously spent 18 months at Ideo developing everything from sunglasses to medical supplies. As he tinkered with a revolutionary single-serve, push-button brewing machine targeted for the workplace, he realized that most makers were as stale as the coffee. "I got to see firsthand how coffee was better by the cup," Nosler says. "The coffee coming out of those glass office pots is wretched." (Starbucks later called the prototype the Interactive Cup.) When the project was finished, Nosler kept thinking about the single-brew concept. He soon decided he could do better, making a superior brewer that wasn't one-size-fits-all.

By 2004, Nosler had cooked up a business plan. He recruited other Stanford alums, including Hulett, 34. Within a year, the team raised half a million dollars from friends and family and set up shop inside an old trolley shed a few minutes north of downtown Seattle. The Coffee Equipment Company was born.

For months, the group reworked the design. They abandoned the office market in favor of cafés, ditched the grinder, and shrunk the countertop footprint. By spring 2005 they had the first Clover prototype. Code name: Chalupa. Made of particleboard, with its guts bolted crudely on the outside, it looked like Mr. Coffee designed by Dr. Frankenstein. But to roasters wanting a high-end single-serve option, it was gorgeous. CEC demo'd a final prototype that October at a local party and sold three units before they were even built. When Clover debuted at the Specialty Coffee Association of America event in 2006, Nosler was mobbed. "People saw us walking in and began chanting, 'Clo-ver, Clo-ver!'" he says, his eyes wide at the memory. To the little indie guys, Nosler was a god.

While interest in CEC was percolating, Starbucks was crashing. Its share price had dipped from nearly $40 in 2006 to around $19 in January 2008. The company that brought macchiato to the masses had lost its way — and a chunk of its profit margin. Was Starbucks in the market of selling coffee drinks or fancy milk shakes? Cappuccinos or compact discs? Was it competing with Peet's or Mickey D's? After just three years, CEO Jim Donald was on his way out, and Schultz, Starbucks' founder, retook the helm. On Valentine's Day 2007, Schultz wrote an internal memo (later leaked to the press) lamenting the state of the company. "I'm not sure people today even know we are roasting coffee," the missive read. "You certainly can't get the message from being in our stores ... At a minimum [we] should support the foundation of our coffee heritage."

Schultz announced that Starbucks would return to its roots. No more vacuum-sealed bags of beans or breakfast sandwiches (the smell of bacon and eggs overwhelmed the coffee aroma). Starbucks would once again grind beans in the store. It would introduce new blends and better espresso machines. But most important: It was going to road-test a little machine that Schultz had discovered a few months before on a walk through New York's Chelsea district. "In my 25 years at Starbucks, the Clover machine unquestionably delivers the best cup of brewed coffee I have ever tasted," Schultz later gushed to his stockholders. "And we want to share this experience with our customers."

Starting in summer 2007, Starbucks discreetly purchased and installed a few Clovers at stores in Seattle and Boston. It sold a cup of Clover-made coffee for as much as $3.05, about a dollar more than Starbucks' regular brew. The early reviews were glowing. As one Yelper put it, "If you're a coffee snob who normally scorns Sbucks and its burnt offerings, you might try the Clover pressed coffee at this location and be pleasantly surprised."

After roughly six months of successful trials, Schultz proposed buying Clover's maker, the Coffee Equipment Company. "We thought Starbucks wanted to take us out on a few dates," Nosler says of the deal. "But they wanted to go steady." Michelle Gass, a senior VP of global strategy for Starbucks, is slightly less romantic: "Frankly, we just don't want anyone else to have it."

Starbucks is willing to share custody, however, of the 250 machines already out there, plus maintain and repair them, but it won't sell any more Clovers to independent cafés. The company has already pulled the plug on CloverNet, the online database that tracks sales, maintenance, and brewing preferences for Clover owners.

Clover's early adopters are outraged to see their coffee machine become part of the Coffee Machine. "We made the decision to purchase the Clover to support this small independent manufacturer," says Stumptown owner Duane Sorenson, who bought the first Clover in the US. "When we found out that CEC was sold to Starbucks, we made the decision to sell our Clovers."

Nosler shrugs off the criticism: "Everyone has their favorite little band that they've watched change as it signs with bigger labels," he says. "But I can defend to anyone that selling to Starbucks was absolutely the right thing for us to do. Starbucks has a larger market than all the independent roasters and specialty shops combined. I'm a product designer first, a coffee guy second. I love coffee; I'm passionate about it, but I want to make products, plural. Having a gigantically hungry customer is appealing on a lot of levels. It was the best of all possible paths for us — and the coffee industry as well."

By the end of 2008, there will 80 machines installed in upscale urban markets across the country. Next year, Starbucks plans to remodel those stores with the Clover as their centerpiece. "Other than espresso, there's been no innovation in brewed coffee to speak of," Schultz says. "Now we're driving new traffic because of the Clover." Then there's that other counter where the Clover is destined to end up — the one in your kitchen. "The Clover is a commercial machine," he says, "but there's potential to create more consumer-based opportunities, specifically at home." Today, you buy a $10 bag of Starbucks French Roast to take home. Soon, you might buy a $40 bag and use your very own Clover to brew it.

Coffee snobs are skeptical. "Clover will differentiate them from the Dunkin' Donuts, the McDonald's," says Tony Konecny, an industry consultant who runs the coffee blog Tonx.org and was one of the first to see a Clover prototype. "But it comes down to the coffee." The machine is only as good as the beans you put in it. Which is a problem for Starbucks, a chain that purchases coffee in mass quantities and can't deliver fresh bags of beans as quickly as the indie cafés. Then there's quality control: "By the time the customer experiences it, the beans have been blended and have been sitting in a bag for six weeks. Anything special about the coffee is lost."

A few days after my cupping room challenge, I'm standing in line at a hilltop Starbucks in Seattle's Queen Anne neighborhood — one of Clover's beta sites. I do a taste test: a cup of Clover coffee versus brewed coffee. A young barista tells me they're out of the first two specialty coffees I request and suggests instead Starbucks' everyday blend, called Pike Place. During brewing, the barista stirs the grounds into the Clover with a clunky rubber spatula — not a metal whisk — and pours the concoction into a crummy paper cup. I smell, I sip, I inhale. I can't tell which cup of coffee is which — and neither is anything special. Is it the beans? My palate? After a few minutes, I finally pick it out: This coffee tastes a little bit like hype.

Mathew Honan (mhonan@gmail.com) offers tips on Twittering in our How To: Self Promote package.

Esquire, E-Ink: Future of Print?

Hollywood's Sudden Cash Crunch

Even Conservatives Hate Michael Savage

Trevor Foltz was six months old last fall, fresh off a visit to Disney World in Orlando, when the spasms first began.

Healthy until that point in his life, he began thrusting backward in his car seat, repeatedly and forcefully, as he rode with his parents north toward home in Rhode Island. "I thought it was temper tantrums," says his mother, Danielle. The next day, at home, Trevor was hit with a series of 40 convulsions and rushed to the hospital, where he was diagnosed with infantile spasms, a rare form of epilepsy. Treatment would cost $1,600 per vial of steroid drug H.P. Acthar Gel, and Trevor would need three of them.

As if the idea of a $4,800 tab wasn't bad enough, when the Foltzes submitted their claim, they found out the company that made the drug, Questcor Pharmaceuticals, had just recently jacked up the price—to $23,000 per vial, or $69,000 for a three-vial treatment—and the insurance company wasn't going to pay. And all the while, unbeknownst to anyone at that time, an alternative, for $15, existed.

On Thursday, the Joint Economic Committee will open hearings in Congress on dramatic price hikes for drugs used to treat children, with a focus on companies such as Questcor and Ovation Pharmaceuticals, which in 2006 bought rights to a drug that treats heart problems in premature infants, and increased the price 1,800 percent to $1,875 per three-vial treatment.

"We need answers to why a company would increase the price of a drug 18-fold when costs related to marketing, physician education, and research appear stable," says hearing chair Amy Klobuchar, a Democratic senator from Minnesota.

Politicians say they are not opposed to drug companies earning strong returns on the costs of researching innovative drugs, and understand the high prices of many medications. But they are investigating whether some companies are price-gouging, concerned more about executive stock options than about running innovative companies.

Some of those drugs, like Questcor's, are decades-old drugs that were bought on the cheap and redesignated under the federal government's Orphan Drug Act, which marks its 25th anniversary this year. Not infrequently, the drugs' new owners pass on big price hikes to consumers.

At Questcor, the increase is explained as the cost of doing business with an orphan drug.

"The company was heading toward bankruptcy," says Steve Cartt, executive vice president for business development at Questcor, which is based in Union City, California, an industrial enclave on San Francisco Bay.

"The whole rationale for the price increase was to ensure availability of the product," says Cartt. "We talked to physicians. They wanted the drug to be available. The choice was risk of availability or a price increase."

Originally approved for multiple sclerosis in 1952, Acthar Gel had been owned by pharma giant Aventis, which was losing money on it, when the 11-year-old Questcor acquired it in 2001. Questcor, too, failed to gain traction with M.S. patients, so it sought a new track.

Now the gears at Questcor began to turn more quickly. It won orphan designation for Acthar Gel in 2003, and proceeded to the next step: getting F.D.A. approval to market the drug explicitly for infantile spasms, which under the orphan act would also include a seven-year monopoly for Questcor. The company prepared for a marketing blitz and doubled its sales force early last year. But when the F.D.A. rejected Questcor's application in May 2007, the company quickly slashed its staff and jacked up the price.

Cartt says the price was set "within the range of other orphan drugs," noting that many others go from $50,000 to $500,000 a year or higher. For instance, BioMarin, an orphan-drug specialty company, charges $70,000 a year for Kuvan, a drug to treat phenylketonuria, a genetic enzyme disorder that can cause mental retardation and brain seizures. But unlike BioMarin, which spends 64 percent of sales on research and development, Questcor spends very little; in 2007, Questcor's research and development accounted for 9.5 percent of sales revenue.

What other considerations played into the price Cartt would not say. Sales for 2007, when the price hike took effect, were $49.7 million, and net income was $37.5 million—a net profit margin of 75 percent. It was significant not only for its size, but also because it was the first profit since the company was formed, as Cypros Pharmaceuticals, in 1990.

Investors were pleased, driving up Questcor's share price from 40 cents to over $6 after the August 2007 price hike. But executives at the company started selling their shares in December, seven months after the former C.E.O., James Fares, stepped down and around the time Questcor executive Don Bailey took his place. Since December, Cartt himself has sold shares based on grants and options totaling $1.68 million; many of those options were granted at 46 cents a share. He holds nearly a million more options on Questcor stock.

Doctors were unhappy with the price hikes.

"Most of us in the child-neurology community were outraged at the extent of the price hike, unusual even for orphan drugs," says Eric Kossoff, a pediatric neurologist and infantile spasms expert at Johns Hopkins Children's Center. "Most of us had no choice, unfortunately. At the time it was felt to be the best drug out there, and they're the only company that makes it. This is an incredibly serious form of epilepsy with devastating implications if not treated."

Curiously, though, he found that the price hike "was one of the best things that could have happened." Why? "Because we found something better and cheaper." Far cheaper, it turns out. "We spent a few days going through all the medical literature, looking for what works, what doesn't."

The team turned up a study from the United Kingdom that gave infants high doses of prednisolone, a well-known, generic steroid. Prednisolone had been dismissed as relatively ineffective for infantile spasms-based research that used low doses. The high doses made all the difference: The British study found efficacy rates reached 70 percent and more. Johns Hopkins began using high-dose prednisolone and found it worked in about 70 percent of cases, on par with the hospital's experience with Acthar Gel. And the price was $15 per injection—essentially free—compared with the three-injection $69,000 treatment from Questcor. "It was like in times of war. You get focused, and amazing things come out," Kossoff says. "We don't use [Acthar Gel] at Hopkins anymore for infantile spasms because the oral steroids [high-dose prednisolone] work just as well."

It's unclear, though, how many other doctors and hospitals in the U.S. will switch from the $69,000 drug to the $15 drug.

"I don't understand what's behind the price increase," says Finbar O'Callaghan, a pediatric neurologist at the Bristol Royal Hospital for Children and coauthor of the United Kingdom Infantile Spasms Study, or UKISS. The study showed that high-dose prednisolone and a synthetic form of ACTH, the active hormone in Acthar Gel, were equally effective. He cautioned that the purpose of the study was not to compare the two, but to compare steroid treatment with another drug called vigabatrin. "Having said that, you couldn't get a piece of paper between the results of the prednisolone and the results of the ACTH."

Costs aside, Hopkins is achieving the same results against Acthar Gel. "There is no reason to favor one over the other, unless there is a financial reason for doing so. That's been a big issue in the U.S.," says O'Callaghan. Comparing $15 against $69,000 "puts a different perspective on it," he says.

"Historically, and unfortunately," he adds, "doctors in general are very traditional and tend to use what's worked before."

Asked about the $15 price on prednisolone, Cartt said studies from the 1990s show low efficacy rates for the drug. When informed that those studies looked at low doses, not high doses, Cartt said no one knows the long-term implications of high-dose prednisolone, and said the company's higher profits will help it find out. "We can afford to study the long-term effects" of Acthar Gel and the alternatives, he said.

What the congressional hearing may find is that Questcor had a business problem: While its drug had a potential market of 300,000 multiple sclerosis patients, not enough of them were buying. But among a smaller market, just 2,000 babies per year, Acthar Gel was extremely effective in fighting infantile spasms. Questcor's astronomical rates may simply be a matter of hard business realities in a small potential market.

For the Foltzes, Questcor's high prices proved irrelevant, after much struggle. When at first his insurance company, WorldWide Insurance, rejected the claim, Trevor's doctor faxed in a letter stating that there was a good chance Trevor would end up mentally retarded for life without treatment; the insurer relented. But on Thursday, his mother, Danielle, will join those who testify against companies like Questcor. She says, "I feel they're going to soak every penny if they can get it."

Google announced on its official blog Wednesday the debut of Knol, a Wikipedia-like online encyclopedia penned by authoritative sources.

Udi Manber loves cartoons. Not animations, but the single-panel graphics that appear in magazines like The New Yorker. He studies the history of the field, has covered the walls of his house with framed originals, and has edited a book of cartoons about Google, where he works as the head of search engineering.

"Udi's not just a fan, he's a connoisseur," says Robert Mankoff, cartoon editor of The New Yorker.

When not thinking about cartoons, Manber spends endless time thinking about how search can be improved. One big reason many searches don't succeed, he believes, is that despite the 20 billion or so Web pages in Google's indexes -- including the 2 million items in Wikipedia -- the information simply isn't there.

For instance, what if you wanted to learn all about Peter Arno, a celebrated New Yorker cartoonist who died in 1968? You wouldn't get lucky. The items appearing in the first page of results give only the barest information on Arno's life and work.

Of course, it's not just information about cartoonists that's missing -- according to Manber there are thousands of black holes when it comes to things searchers want to know. What people need, Manber concluded about a year-and-a-half ago, is the information that would come "when an expert who knows this topic would tell you, if they had 15 minutes to explain."

So Manber began what he refers to as his pet project -- an effort to generate exactly those kind of answers in the top search results. The product, announced Wednesday, is called Knol.

"It's a nice, very simple word to remember, and it's part of knowledge," says Manber.

Google hopes that Manber's project will give experts who know their stuff a platform to share it with everyone else. Google is especially keen on seeding this information internationally, in languages where the online corpus is sparse.

Here's how Knol works. Experts in a given subject log into a Google account and use the Knol software to post an item, also known as a knol. In some senses, the process is like producing a blog post -- but in this case it's not something written off the cuff but carefully crafted to coherently explain a single subject.

One key attribute: Knols are meant to be signed with the author's actual name. With permission, Google will actually verify the writer's identity, either by credit card or phone.

"The process will take 20 seconds with credit cards," says Knol product manager Cedric Dupont. Phone checks will take a minute or so. This vetting, Manber hopes, will give knols accountability and, in the case of high-status authors, the benefit of a solid reputation.

The format and tone are up to the author: Google won't intervene if your knol on F. Scott Fitzgerald opines that The Great Gatsby was really a dud. And it will certainly help if the knol delivers the goods in a pithy, captivating style. (Google won't, however, tolerate knols that violate copyright or include porn.)

Google is attempting to establish a model for a standard item, and has seeded the "Knolosphere" with a few hundred entries appearing on launch, largely in the field of health and medicine. Working with Google on this is Robert M. Wachter, a professor of medicine at the University of California, who also sits on Google's health advisory council.

Just like blogs, knols can include images, video and links. As a special bonus, The New Yorker will allow knol authors to include, free of charge, a single cartoon from the publication's 20,000-image archive to illuminate the subject. (Guess which Googler was behind that deal.)

Knols are treated pretty much like any web page -- found by following links, but readers will encounter most through search results from Google or other search engines. Google says that knols will get no special favors when its algorithms choose results, but clearly expects the best efforts to rocket towards the top of search results. Maybe even ahead of the ubiquitous Wikipedia items.

"A high-quality knol will rise up not just on Google but all the search engines," says Michael McNally, the project's technical lead.

There's no limit on how many people can write knols on the same subjects, but presumably the inferior ones will be stalled in the back results pages while searchers encounter the best ones immediately.

Why would an expert on a subject take the time to write a knol? One reason would be an altruistic impulse to share wisdom with the world. There's also the ego juice that might come with being the first authority one encounters in a search for absinthe or Daryl Lamonica. By default, knols use a Creative Commons copyright license, which allows copying and remixing. If they wish, authors can change the settings to register traditional copyright protection.

In addition, there's money involved. If authors OK it, Google will compensate them with revenue from advertisements served by the company's AdSense program. If someone writes a top-ranked knol on a subject that's matched with high-value clicks from Google ads (diseases, travel destinations, personal finance), the payout could be thousands of dollars. (Purists can keep the ads off.)

But Manber is emphatic that his project is not about the bucks. "If Knol doesn't improve search but generates some revenues, that'll be a failure for me," he says.

Many people, however, will find it puzzling that Google thinks it necessary to create a new platform for people to share information. Why bother, when Wikipedia will give you answers whether you're wondering about George M. Dallas (James Polk's vice-president) or the 13th Floor Elevators (an Austin psychedelic rock band formed in late 1965)?

One person asking that question is Wikipedia co-founder Jimmy Wales, who learned about Knol a few months ago, when Google posted a blog teaser about the project.

"What is the added value?" Wales asks. "People already can put up web pages somewhere on the internet, put some ads on it if they want to get revenue or not put ads if they don't want the revenue."

Wales clearly thinks that his brainchild will satisfy most searchers. "If I type in Thomas Jefferson, there's a pretty good chance that the Wikipedia entry is more or less exactly what I'm looking for," he says.

Google says it isn't trying to compete with Wikipedia, but providing an alternative.

"I'm not suggesting one is better than the other, but different," says Manber.

And what would the difference be?

"One article is written by one person, and it's one person's opinion," says Manber. "You know who that person is and where they're coming from."

During one of my interviews with Manber I asked him to compare the first commissioned knol, about insomnia, with a Wikipedia item. The knol was written by Manber's wife, Rachel, who is an associate professor at Stanford University's Psychiatry and Behavioral Science Sleep Center.

Though Rachel Manber's item is a more coherent and thorough treatment of the subject than Wikipedia's, in some respects it's similar to the crowdsourced entry: a general definition followed by a discussion of causes and treatments.

But the top of the Wikipedia page on insomnia displays this caveat: "This article is in need of attention from an expert on the subject." Touché.

By the way, Google isn't rejecting the wisdom of the crowd. Once an author creates a knol, the general public can improve it. People can suggest corrections, edits and amendments to the content -- a technique Google calls "a moderated edit."

Readers can also leave comments alongside the content. While the author is the arbiter of the item itself, and can reject suggestions, he or she can't delete the comments. Users can also rate knols on a five-star scale.

"I'm sure there will be knol spam," says Dupont, who says that Google will use its experience fighting spam in Blogger and other products to minimize it.

"If Google is able to pull it off, bring expert knowledge to the masses, that's absolutely wonderful," says Jorge Cauz, president of Encyclopedia Britannica, the company best known for providing trusted expert information in an encyclopedia format.

It's not Google that worries him, but Wikipedia, and he sounds like he'd like some help fending off Britannica's crowdsourced rival. "It's not the presence of Wikipedia that's a problem, it's the omnipresence of Wikipedia," he says.

In fact, he says, from what he hears about Knol, "it's very similar to things we're thinking and retooling Britannica to do." He hints that the company might be changing from its subscription model to a scheme where much of its content would be free to users -- and show up in search engines.

"If you're charging for content, you're behind the firewall. And if you're behind the firewall people don't call on you first," he says. As part of this process Britannica now encourages anyone to link to its items. Those following the link can read the full article free. Britannica also posts a daily info-nugget on Twitter.

But Cauz does imply that Google is stepping out of its sweet spot by generating content. "The issue here is that Google will become a publisher and will have moral liability and moral obligation for something that happens under its own brand -- and that is something that Google has never done," he says.

Google sees it differently, viewing Knol as a common-carrier platform like Blogger or YouTube. Knol pages won't even carry a Google logo.

"We are not publishers," says Manber. "We do not want to be editors. We do not want to have influence over what is written." He can't say it enough: It's about search. "There are millions of people with something in their head that they're not writing down," he says. "If I can get some of them to write it down, I'm helping everybody."

If Google's plan works, future searchers will get higher-quality results from searches of subjects commonplace and obscure -- even Peter Arno. In fact, a knol has already been written about The New Yorker cartoonist. If its author posts it -- he hasn't pulled the trigger yet -- Google won't have to work hard to verify the expert who worked for weeks to pen that item. It's Udi Manber.

---

Disclosure: Wired.com is owned by Condé Nast, publisher of The New Yorker.

What's the difference between an indie game and a blockbuster? About 5 million man-hours. Producing a big-budget title like Grand Theft Auto 4 requires armies of people to spend years painstakingly sculpting every individual object in the game world. Indie games, which are designed by small teams of geeks, can't possibly match that. But an increasing number of garage coders are building elaborate 3-D environments by outsourcing the design work — not to Bangalore, but to algorithms.

Take the upcoming online game Love (shown here), due out later this year. Around 100 players will be able to explore the virtual world together, establish towns, and fight monsters. And its impressionistic watercolor environment was created by an army of one, Swedish coder Eskil Steenberg.

Love's world starts as a generic landscape divided into almost 100,000 blocks. "The game's engine uses an algorithm to turn the blocks into hills, valleys, and oceans," Steenberg says — a method called procedural generation. It then examines the terrain and adds bridges, tunnels, and buildings to ensure that each area is interesting and accessible. Once the world is created, it can still be modified. "It's like a Lego kit that both the players and the game itself can use," he says. Players can rearrange trees and boulders, reconfigure buildings, or hollow out new caves in hillsides. The gorgeous vistas are also subject to natural phenomena like erosion, thanks to Steenberg's tectonics system.

Love's vast, morphing creation demonstrates how one man can become like a god — he sets the world in motion and lets simple rules, random numbers, and inhabitants do the rest.

It was the year Ronald Reagan called the Soviet Union an "evil empire"; the year the United Nations implored the Russians to withdraw from Afghanistan; the year ABC aired The Day After, a TV movie about the wake of a nuclear attack on the US. In the midst of all this came WarGames, a fizzy little thriller about looming Armageddon. It's a deceptively simple story: High schooler David Lightman (played by 21-year-old Matthew Broderick) is a digitally proficient goofball who wants to play an unreleased computer game — and impress a pretty girl (Ally Sheedy). So he does something most Americans didn't have a word for back then: He starts hacking. Little does he know, the "computer company" he's infiltrated is actually a military installation running a missile-command supercomputer called the WOPR (War Operation Plan Response), and the game — Global Thermonuclear War — is real. Naturally, only David can stop it from setting off World War III.

Over the years, WarGames has written itself into the cult lore of Silicon Valley. Google hosted a 25th-anniversary screening in May, where keyboard jockeys cheered Broderick's DOS acrobatics. (Imagine Rocky Horror, but picture the audience in Hawaiian shirts and mandals.) "Many of us grew up with this movie," Google cofounder Sergey Brin told the packed house. "It was a key movie of a generation, especially for those of us who got into computing."

How did WarGames become the geek-geist classic that legitimized hacker culture, minted the nerd hero — and maybe even changed American defense policy? Related question: Shall we play a game?

In 1979, Walter Parkes, the future head of DreamWorks Pictures, was a young screenwriter with the outlines of an idea he'd developed with Lawrence Lasker, a script reader at Orion Pictures. Called The Genius,it was a character film about a dying scientist and the only person in the world who understands him — a rebellious kid who's too smart for his own good. The idea of featuring computers and computer networks would come later.

Walter Parkes, Screenwriter: WarGames is looked upon as technologically prescient, but we actually started off with a concept that had nothing to do with technology.

Lawrence Lasker, Screenwriter: We were complete newbies. In 1979, we didn't even know that home computers could hook up to other computers.

Peter Schwartz, Futurist and creative consultant: I spent 10 years at the Stanford Research Institute, from 1972 to the end of 1981. That's where all this began. Walter and Larry came to SRI with a script idea called The Genius. And it was about a boy and a relationship he had with a great scientist named Falken, who was basically Stephen Hawking.

Lasker: For me, the inspiration for the project was a TV special Peter Ustinov did on several geniuses, including Hawking. I found the predicament Hawking was in fascinating — that he might one day figure out the unified field theory and not be able to tell anyone, because of his progressive ALS. So there was this idea that he'd need a successor. And who would that be? Maybe this kid, a juvenile delinquent whose problem was that nobody realized he was too smart for his environment. That resonated with Walter. So I said, let's actually go talk to people about how a kid could get in trouble and get discovered by a brainy scientist and take it from there.

Parkes: Before our conversation, the Falken character was just a way to access the adult side of the movie. It wasn't even much about computers yet.

Schwartz made the connection between youth, computers, gaming, and the military — and The Genius began its long morph into WarGames.

Schwartz: There was a new subculture of extremely bright kids developing into what would become known as hackers. SRI was in Palo Alto, and all the computer nerds were around: Xerox PARC, Apple just starting — it was all happening right there. SRI was node number two of the Internet. We talked about the fact that the kinds of computer games that were being played were blow-up-the-world games. Space war games. Military simulations. Things like Global Thermonuclear War. SRI was one of the main players in this. SRI was, in fact, running computerized war games for the military.

In the summer of 1980, Parkes and Lasker went looking for inspiration for their war room set. They found it when they pestered their way onto a tour of the North American Aerospace Defense Command's central nerve center — 2,000 feet under Cheyenne Mountain in Colorado. From here, American and Canadian military officials could detect an incoming Soviet nuke from hundreds of miles away.

Lasker: As we're walking back to the bus that's going to take us to the hotel, James Hartinger [then commander in chief of Norad] walks up between me and Walter and plants a hand on the back of our necks: "I understand you boys are writing a movie about me!" he says. "Let's go to the bar." Walter says: "Well, we have to get on the bus to go back to our hotel." And Hartinger replies: "Are you insane? I've got 50,000 men under my command. You think I can't get you back to your hotel? Plus, I can't drink off the base. So c'mon." He was all for the message in our script. We kind of simplified it to "machines are taking over." He said, "God damn, you're right! I sleep well at night knowing I'm in charge." So we based General Beringer, played by Barry Corbin, on the real commander at Cheyenne Mountain.

Parkes: We came up with a number of different military-themed plotlines prior to the final story. In one version, this kid was connected via computer to someone known as Uncle Ollie, or OLI. Later on, it's revealed that OLI stands for Omnipresent Laser Interceptor, a space-based defensive laser, and it's got this intelligent program running it. This was another version of what the WOPR became. We could never make it work, but I remember doing quite a lot of research into space- and Earth-based laser systems. It turned out to be too speculative, not as specific as what we decided on.

David Scott Lewis, Solar-tech entrepreneur and model for David Lightman: Hacking was easy back then. There were few if any security measures. It was mostly hackers versus auditing types. The Computer Security Institute comes to mind. I would read all of their materials and could easily find ways around their countermeasures. The part in the movie showing David Lightman perusing the library to find Falken's backdoor password, "Joshua," is clearly a reference to many of my antics.

Lasker: David Lewis wasn't exactly the inspiration. But he was a model. You could call him up in the middle of the night and ask, "Can you get a computer to play games with itself?" And he'd say, "Yes! Number of players: zero."

Parkes: There was a guy named "Captain Crunch," John Draper. He was the famous phone phreak, one of the first telephone hackers. He was called Captain Crunch because he used a toy whistle given away in the cereal to activate a telephone trunk line, enabling him to make unlimited free calls.

John "Captain Crunch" Draper, Early hacker and reformed phone phreak: I talked to them about how phone phreaks did it: The use of a dialer scanner program came from me repeatedly dialing up numbers until I found a computer modem. It's called wardialing now because David Lightman used it in the movie to make contact with the Norad computer. I called it scanning.

Kevin "The Condor" Mitnick, Early hacker who served five years in prison for computer-related crimes: Scanning was a common hacking technique. But it seemed like something from a James Bond movie.

In early '82 , the script grew so ambitious that the filmmakers needed to build the Hollywood version of Norad's Crystal Palace command center. Universal Pictures began to balk at the prospect of shooting a tech-heavy movie its executives didn't fully understand. The project stalled and ended up at United Artists, where director Martin Brest was hired. He began making changes in the script, starting with the key character, Falken.

Lasker: I still wish we'd been able to stick with the original dying-astrophysicist character. It was Marty Brest who didn't like the idea of a man in a wheelchair in a war room, because it was too much like Dr. Strangelove.

Parkes We always pictured John Lennon, because he was kind of a spiritual cousin to Stephen Hawking.

Lasker: We had communicated with Hawking — not directly. And through David Geffen, we'd communicated with John Lennon, and he was interested in the role. I was writing the first scene where we meet Hawking — Falken — in the movie. He was an astrophysicist in our second draft. I was staring at the cover of the November '80 issue of Esquire, with Lennon on the cover, and describing his face, when a friend of mine — a bit of a jerk — called and said, "You're gonna have to find a new Falken."

They had to find a new director, too; UA wasn't happy with the footage Brest had produced. The studio fired him and called in John Badham, the acclaimed director of Saturday Night Fever.

Geek Goddess

Those eyes. That laugh. Those khakis. For a legion of young WarGames fans, 20-year-old Ally Sheedy was a lust object second only to the Imsai 8080. A quarter century later, Wired caught up with hacker culture's first crush. — Scott Brown

John Badham, Director Leonard Goldberg, the producer, shows me some footage they'd shot — it was a scene with Matthew Broderick and Ally Sheedy going into his bedroom, early in the movie, and he shows her how he can change her grades on his computer. She freaks out and leaves. And I'm looking at this and thinking, "What's wrong here?" Driving home that night, I realized what it was. I stopped the car, found a phone booth, and called Leonard. "I know what the problem is!" I said. "They're not having any fun!" These kids were treating this as if they're involved in some dark and evil terrorist conspiracy. If I could change somebody's grades on the computer, I'd be peeing in my pants with excitement to show it to some girl. And the girl would be excited about it! I wasn't taking the point of view that there was something wrong with this guy.

Parkes: There was such a myth that we were all subject to, that personal computing would lead to a generation of disconnected loners who stayed in their rooms. But it actually led to social networking of a kind we've never seen before. The David Lightman character we first wrote was an edgier character than the one that Matthew portrayed. The final version was edgy enough but in a slightly more playful way.

Schwartz: The first thing on his mind was impressing the girl: "I'm changing your biology grade!" He was more about that than the art of hacking. The two computer nerds he goes to visit, Malvin and Jim (played by Eddie Deezen and Maury Chaykin), are much more in the mold of the conventional hacker.

Eddie Deezen, Actor [New Yorker film critic] Pauline Kael said that I was the first computer nerd of film, and since then nobody has ever challenged me.

To ensure accuracy, Badham invited a small army of computer whizzes on set.

Badham: You could get all the hacker geekiness you wanted just by standing on the set. We were dealing with things like when Matthew sits at the computer, we've got an actor who can't even type. I'd say, "No, I just really want him to type in 'David' and have him get on." They said, "No! You can't do that! You have to go through all these elaborate sequences!" I said, "No, we're not doing that. Audiences will have left the theater by the time he logs into the computer one time."

Draper: I was taken down to the set as a technical assistant. I don't really believe that there were any technical glitches — the fact that you can find a game company by scanning for phone numbers was real. That military computer, the WOPR, on the other hand, was a stupid, crazy thing. That was crazy. That was silly.

Made for $12 million, the movie was released on June 6, 1983. It was a hit, nabbing $80 million at the box office (the fifth-highest total of the year) and three Oscar nominations (for original screenplay, sound, and cinematography). Film critic Roger Ebert described it as "an amazingly entertaining thriller" and "one of the best films so far this year." When the WOPR spoke the movie's penultimate line ("A strange game. The only winning move is not to play. How about a nice game of chess?"), audiences, unnerved by years of US-Soviet nuclear brinkmanship, spontaneously applauded. And Ronald Reagan did not find the WOPR crazy or silly when he saw the movie at a special Camp David screening during its opening weekend.

Lasker: I arranged that screening. Reagan was a family friend. My parents were in the movie business, and I grew up in Brentwood. We had Saturday night parties, and much the same people came. The Reagans — you could set your watch by them. At 7 o'clock, there they would be — ding-dong!

Days after the screening, wrote Washington Post reporter Lou Cannon, Reagan held a closed-door briefing with some moderate members of Congress, wherein he sidetracked discussion of the MX ballistic missile program by bringing upWarGames. Had any of them seen the film? he asked, then launched into an animated account of the plot. "Don't tell the ending," cautioned one of the lawmakers.

Parkes: I remember the Bulletin of the Atomic Scientists Doomsday Clock was at three minutes to midnight. The timing of it all was really interesting.

William Lord, Commander, Air Force Cyberspace Command: It was a great movie! A few years later, I was an executive officer with the Air Force Space Command stationed at Norad near Cheyenne Mountain. And I'm wondering, "Gee, where can we get such cool-looking displays?" It was a good forcing function. It required us to all of a sudden say, "If it really can look like this, why doesn't it?"

WarGames had its most indelible influence on hacker culture, not defense policy. The Cold War was ending, but the cyberwar was just getting started. The year after the movie's release saw the debut of 2600 magazine — a hacker zine named after the 2600-Hz tone Draper used to phreak phones. In 1993, the first hacker convention opened its doors. It was (and is) called Defcon, an affectionate nod to the movie that helped popularize the term. But WarGames' legacy isn't all smileys and Sunday wardrives. This was Silicon Valley's Jaws, doing for the digital demimonde what Spielberg's thriller had done for sharks: It introduced the world to the peril posed by hackers.

Mitnick: That movie had a significant effect on my treatment by the federal government. I was held in solitary confinement for nearly a year because a prosecutor told a judge that if I got near a phone, I could dial up Norad and launch a nuclear missile. I never hacked into Norad. And when the prosecutor said that, I laughed — in open court. I thought, "This guy just burned all his credibility." But the court believed it. I think the movie convinced people that this stuff was real. They tried to make me into a fictional character.

Parkes: Between John's instinct and Matthew's interpretation, Lightman ended up being a more accessible, real kid. We didn't know it at the time — we went into this researching hackers — but we probably drew a picture of a gamer. I mean, look at the line "I wanna play those games."

Lewis: In those days, there were no blackhats or whitehats. I didn't do anything too serious. Just wanted to see what I could get away with. Just like in the movie.

Parkes: If there's something naive about the movie, it's that we didn't anticipate the power of hackers. For the handful of people who ended up doing things like unleashing viruses, well, most of those guys got arrested and then worked for the computer security business. So I guess it's all worked out.

Mitnick: It was a cool script, and Lightman becomes the hero. He was just doing it for fun. Today people aren't doing it for the fun. I was an old-school hacker, doing it for intellectual curiosity. It was more innocent. Trying to find a cool game to play and accidentally stumbling across a game that was for real.

Contributing editor Scott Brown (scott_brown@wired.com) wrote about the new Batman movie in issue 16.07. Additional reporting by David Downs.